GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

RHSA-2026:65851

Vulnerability from csaf_redhat - Published: 2026-09-17 08:01 - Updated: 2026-09-18 13:37
Summary
Red Hat Security Advisory: OpenShift Container Platform 4.18.55 bug fix and security update
Severity
Important
Notes
Topic: Red Hat OpenShift Container Platform release 4.18.55 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.18.55. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:66385 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ Security Fix(es): * bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012) * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893) * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822) * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816) * sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * samba: vfs_worm does not block directory modification (CVE-2026-2340) * gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison (CVE-2026-3833) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) * libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164) * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-1519

A flaw was found in BIND. A remote attacker could exploit this vulnerability by sending a maliciously crafted DNSSEC-validated zone to a BIND resolver. This could cause the resolver to consume excessive CPU resources, leading to a denial of service (DoS) for legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Unresolved product id: 9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0 —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0 —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0 —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-2340

A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE-280 - Improper Handling of Insufficient Permissions or Privileges
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Moderate
CVE-2026-3012

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.

8.0 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE-345 - Insufficient Verification of Data Authenticity
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Important
CVE-2026-3039

A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending maliciously-constructed packets to BIND servers configured for TKEY-based authentication via GSS-API (Generic Security Service Application Program Interface) tokens. This can lead to excessive memory consumption, resulting in a Denial of Service (DoS) for the affected server.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Important
CVE-2026-3833

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-178 - Improper Handling of Case Sensitivity
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Moderate
CVE-2026-5946

A flaw was found in the bind component, specifically within the `named` daemon. This vulnerability allows a remote attacker to send specially crafted Domain Name System (DNS) messages. These messages, which use unusual classes or meta-classes, can trigger assertion failures in the `named` daemon when processed. Successful exploitation leads to an application level Denial of Service (DoS), making the DNS service unavailable.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1287 - Improper Validation of Specified Type of Input
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Important
CVE-2026-6893

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.

7.5 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Important
CVE-2026-10723

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.

6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
CWE-345 - Insufficient Verification of Data Authenticity
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Moderate
CVE-2026-11331

A flaw was found in BIND 9, a widely used Domain Name System (DNS) software. A remote attacker could exploit this by sending specially crafted, excessively long DNS queries. This could bypass Response Policy Zone (RPZ) rules, which are designed to block access to malicious domains, and potentially cause the BIND 9 software to crash, leading to a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-20 - Improper Input Validation
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Important
CVE-2026-11822

A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed against such a database, an attacker can cause process crashes, memory exhaustion, or achieve arbitrary code execution, potentially compromising the system.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Important
CVE-2026-11824

A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-191 - Integer Underflow (Wrap or Wraparound)
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Important
CVE-2026-13321

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone.

8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CWE-345 - Insufficient Verification of Data Authenticity
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Important
CVE-2026-14164

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-415 - Double Free
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Moderate
CVE-2026-15816

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

7.5 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Important
CVE-2026-16313

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.

7.6 (High)
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Important
CVE-2026-29111

A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-1287 - Improper Validation of Specified Type of Input
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Moderate
CVE-2026-39821

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.

8.2 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
CWE-1289 - Improper Validation of Unsafe Equivalence in Input
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Important
CVE-2026-43112

A flaw was found in the Linux kernel's CIFS (Common Internet File System) client. When the `cifs_sanitize_prepath` function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-bounds read can lead to a system crash, resulting in a denial of service.

8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 4 products, the same list as for CVE-2026-1519
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:65851 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2445763 external
https://bugzilla.redhat.com/show_bug.cgi?id=2447318 external
https://bugzilla.redhat.com/show_bug.cgi?id=2447319 external
https://bugzilla.redhat.com/show_bug.cgi?id=2450505 external
https://bugzilla.redhat.com/show_bug.cgi?id=2451305 external
https://bugzilla.redhat.com/show_bug.cgi?id=2459963 external
https://bugzilla.redhat.com/show_bug.cgi?id=2467015 external
https://bugzilla.redhat.com/show_bug.cgi?id=2479767 external
https://bugzilla.redhat.com/show_bug.cgi?id=2479771 external
https://bugzilla.redhat.com/show_bug.cgi?id=2480756 external
https://bugzilla.redhat.com/show_bug.cgi?id=2487258 external
https://bugzilla.redhat.com/show_bug.cgi?id=2487269 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493411 external
https://bugzilla.redhat.com/show_bug.cgi?id=2500889 external
https://bugzilla.redhat.com/show_bug.cgi?id=2502845 external
https://bugzilla.redhat.com/show_bug.cgi?id=2503721 external
https://bugzilla.redhat.com/show_bug.cgi?id=2504166 external
https://bugzilla.redhat.com/show_bug.cgi?id=2504560 external
https://issues.redhat.com/browse/OCPBUGS-66128 external
https://issues.redhat.com/browse/OCPBUGS-77052 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-1519 self
https://bugzilla.redhat.com/show_bug.cgi?id=2451305 external
https://www.cve.org/CVERecord?id=CVE-2026-1519 external
https://nvd.nist.gov/vuln/detail/CVE-2026-1519 external
https://downloads.isc.org/isc/bind9/9.18.47 external
https://downloads.isc.org/isc/bind9/9.20.21 external
https://downloads.isc.org/isc/bind9/9.21.20 external
https://kb.isc.org/docs/cve-2026-1519 external
https://access.redhat.com/security/cve/CVE-2026-2340 self
https://bugzilla.redhat.com/show_bug.cgi?id=2447318 external
https://www.cve.org/CVERecord?id=CVE-2026-2340 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2340 external
https://bugzilla.samba.org/show_bug.cgi?id=15997 external
https://access.redhat.com/security/cve/CVE-2026-3012 self
https://bugzilla.redhat.com/show_bug.cgi?id=2447319 external
https://www.cve.org/CVERecord?id=CVE-2026-3012 external
https://nvd.nist.gov/vuln/detail/CVE-2026-3012 external
https://bugzilla.samba.org/show_bug.cgi?id=16003 external
https://access.redhat.com/security/cve/CVE-2026-3039 self
https://bugzilla.redhat.com/show_bug.cgi?id=2479767 external
https://www.cve.org/CVERecord?id=CVE-2026-3039 external
https://nvd.nist.gov/vuln/detail/CVE-2026-3039 external
https://access.redhat.com/security/cve/CVE-2026-3833 self
https://bugzilla.redhat.com/show_bug.cgi?id=2445763 external
https://www.cve.org/CVERecord?id=CVE-2026-3833 external
https://nvd.nist.gov/vuln/detail/CVE-2026-3833 external
https://gitlab.com/gnutls/gnutls/-/issues/1803 external
https://access.redhat.com/security/cve/CVE-2026-5946 self
https://bugzilla.redhat.com/show_bug.cgi?id=2479771 external
https://www.cve.org/CVERecord?id=CVE-2026-5946 external
https://nvd.nist.gov/vuln/detail/CVE-2026-5946 external
https://access.redhat.com/security/cve/CVE-2026-6893 self
https://bugzilla.redhat.com/show_bug.cgi?id=2459963 external
https://www.cve.org/CVERecord?id=CVE-2026-6893 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6893 external
https://access.redhat.com/security/cve/CVE-2026-10723 self
https://bugzilla.redhat.com/show_bug.cgi?id=2504560 external
https://www.cve.org/CVERecord?id=CVE-2026-10723 external
https://nvd.nist.gov/vuln/detail/CVE-2026-10723 external
https://access.redhat.com/security/cve/CVE-2026-11331 self
https://bugzilla.redhat.com/show_bug.cgi?id=2503721 external
https://www.cve.org/CVERecord?id=CVE-2026-11331 external
https://nvd.nist.gov/vuln/detail/CVE-2026-11331 external
https://access.redhat.com/security/cve/CVE-2026-11822 self
https://bugzilla.redhat.com/show_bug.cgi?id=2487258 external
https://www.cve.org/CVERecord?id=CVE-2026-11822 external
https://nvd.nist.gov/vuln/detail/CVE-2026-11822 external
https://sqlite.org/releaselog/3_53_2.html external
https://sqlite.org/src/info/061febcf41ca external
https://sqlite.org/src/info/4a5ad516ea93 external
https://www.vulncheck.com/advisories/sqlite-befor… external
https://access.redhat.com/security/cve/CVE-2026-11824 self
https://bugzilla.redhat.com/show_bug.cgi?id=2487269 external
https://www.cve.org/CVERecord?id=CVE-2026-11824 external
https://nvd.nist.gov/vuln/detail/CVE-2026-11824 external
https://www.vulncheck.com/advisories/sqlite-befor… external
https://access.redhat.com/security/cve/CVE-2026-13321 self
https://bugzilla.redhat.com/show_bug.cgi?id=2504166 external
https://www.cve.org/CVERecord?id=CVE-2026-13321 external
https://nvd.nist.gov/vuln/detail/CVE-2026-13321 external
https://access.redhat.com/security/cve/CVE-2026-14164 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493411 external
https://www.cve.org/CVERecord?id=CVE-2026-14164 external
https://nvd.nist.gov/vuln/detail/CVE-2026-14164 external
https://github.com/libarchive/libarchive/issues/3069 external
https://github.com/libarchive/libarchive/pull/3071 external
https://access.redhat.com/security/cve/CVE-2026-15816 self
https://bugzilla.redhat.com/show_bug.cgi?id=2500889 external
https://www.cve.org/CVERecord?id=CVE-2026-15816 external
https://nvd.nist.gov/vuln/detail/CVE-2026-15816 external
https://bugzilla.redhat.com/show_bug.cgi?id=2459963 external
https://github.com/dracutdevs/dracut/blob/master/… external
https://github.com/dracutdevs/dracut/blob/master/… external
https://access.redhat.com/security/cve/CVE-2026-16313 self
https://bugzilla.redhat.com/show_bug.cgi?id=2502845 external
https://www.cve.org/CVERecord?id=CVE-2026-16313 external
https://nvd.nist.gov/vuln/detail/CVE-2026-16313 external
https://github.com/doug-gilbert/sg3_utils/pull/83 external
https://access.redhat.com/security/cve/CVE-2026-29111 self
https://bugzilla.redhat.com/show_bug.cgi?id=2450505 external
https://www.cve.org/CVERecord?id=CVE-2026-29111 external
https://nvd.nist.gov/vuln/detail/CVE-2026-29111 external
https://github.com/systemd/systemd/commit/1d22f70… external
https://github.com/systemd/systemd/commit/20021e7… external
https://github.com/systemd/systemd/commit/2116700… external
https://github.com/systemd/systemd/commit/3cee294… external
https://github.com/systemd/systemd/commit/42aee39… external
https://github.com/systemd/systemd/commit/54588d2… external
https://github.com/systemd/systemd/commit/7ac3220… external
https://github.com/systemd/systemd/commit/80acea4… external
https://github.com/systemd/systemd/commit/b5fd146… external
https://github.com/systemd/systemd/commit/efa6ba2… external
https://github.com/systemd/systemd/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-39821 self
https://bugzilla.redhat.com/show_bug.cgi?id=2480756 external
https://www.cve.org/CVERecord?id=CVE-2026-39821 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39821 external
https://go.dev/cl/767220 external
https://go.dev/issue/78760 external
https://groups.google.com/g/golang-announce/c/iI-… external
https://pkg.go.dev/vuln/GO-2026-5026 external
https://access.redhat.com/security/cve/CVE-2026-43112 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467015 external
https://www.cve.org/CVERecord?id=CVE-2026-43112 external
https://nvd.nist.gov/vuln/detail/CVE-2026-43112 external
https://lore.kernel.org/linux-cve-announce/202605… external
Acknowledgments
Aisle Research Pavel Kohout
DREAM Security Research Team Arad Inbar Nir Somech Ben Grinberg
Michalis Vasileiadis
AISLE Research
Red Hat Pavel Valena
Shaomin Chen
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Container Platform release 4.18.55 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\n This release includes a security update for Red Hat OpenShift Container\nPlatform 4.18.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container\nPlatform 4.18.55. See the following advisory for the RPM packages for this\nrelease:\n\nhttps://access.redhat.com/errata/RHSA-2026:66385\n\nSpace precludes documenting all of the container images in this advisory.\nSee the following Release Notes documentation, which will be updated\nshortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nSecurity Fix(es):\n\n* bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated\nzone (CVE-2026-1519)\n* samba: group policy certificate enrollment uses http:// without\nvalidation (CVE-2026-3012)\n* bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation\n(CVE-2026-3039)\n* bind: BIND: Denial of Service via specially crafted DNS messages\n(CVE-2026-5946)\n* dracut: dracut: Root code execution via DHCP options command injection\n(CVE-2026-6893)\n* bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)\n* sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text\nsearch data (CVE-2026-11822)\n* sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer\noverflow in FTS5 (CVE-2026-11824)\n* bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field\n(CVE-2026-13321)\n* dracut: dracut: root code execution via unescaped error message written\nto sourced emergency hook script in die() (CVE-2026-15816)\n* sg3_utils: sg3_utils: arbitrary command execution via udev property\ninjection in sg_inq --export (CVE-2026-16313)\n* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege\nescalation via incorrect Punycode label processing (CVE-2026-39821)\n* kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath\n(CVE-2026-43112)\n* samba: vfs_worm does not block directory modification (CVE-2026-2340)\n* gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints\ncomparison (CVE-2026-3833)\n* bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)\n* libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via\ndangling filtered_buf pointer in init_unpack() (CVE-2026-14164)\n* systemd: systemd: Arbitrary code execution or Denial of Service via\nspurious IPC API call data (CVE-2026-29111)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:65851",
        "url": "https://access.redhat.com/errata/RHSA-2026:65851"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2445763",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
      },
      {
        "category": "external",
        "summary": "2447318",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447318"
      },
      {
        "category": "external",
        "summary": "2447319",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447319"
      },
      {
        "category": "external",
        "summary": "2450505",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450505"
      },
      {
        "category": "external",
        "summary": "2451305",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451305"
      },
      {
        "category": "external",
        "summary": "2459963",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963"
      },
      {
        "category": "external",
        "summary": "2467015",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467015"
      },
      {
        "category": "external",
        "summary": "2479767",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479767"
      },
      {
        "category": "external",
        "summary": "2479771",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479771"
      },
      {
        "category": "external",
        "summary": "2480756",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
      },
      {
        "category": "external",
        "summary": "2487258",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487258"
      },
      {
        "category": "external",
        "summary": "2487269",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487269"
      },
      {
        "category": "external",
        "summary": "2493411",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493411"
      },
      {
        "category": "external",
        "summary": "2500889",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500889"
      },
      {
        "category": "external",
        "summary": "2502845",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502845"
      },
      {
        "category": "external",
        "summary": "2503721",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503721"
      },
      {
        "category": "external",
        "summary": "2504166",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504166"
      },
      {
        "category": "external",
        "summary": "2504560",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504560"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-66128",
        "url": "https://issues.redhat.com/browse/OCPBUGS-66128"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-77052",
        "url": "https://issues.redhat.com/browse/OCPBUGS-77052"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65851.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Container Platform 4.18.55 bug fix and security update",
    "tracking": {
      "current_release_date": "2026-09-18T13:37:02+00:00",
      "generator": {
        "date": "2026-09-18T13:37:02+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.21"
        }
      },
      "id": "RHSA-2026:65851",
      "initial_release_date": "2026-09-17T08:01:27+00:00",
      "revision_history": [
        {
          "date": "2026-09-17T08:01:27+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-17T08:01:27+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-18T13:37:02+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4.18",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.18",
                  "product_id": "9Base-RHOSE-4.18",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:4.18::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-aarch64-418.94.202609031320-0",
                "product": {
                  "name": "rhcos-aarch64-418.94.202609031320-0",
                  "product_id": "rhcos-aarch64-418.94.202609031320-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@418.94.202609031320?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-ppc64le-418.94.202609031320-0",
                "product": {
                  "name": "rhcos-ppc64le-418.94.202609031320-0",
                  "product_id": "rhcos-ppc64le-418.94.202609031320-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@418.94.202609031320?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-s390x-418.94.202609031320-0",
                "product": {
                  "name": "rhcos-s390x-418.94.202609031320-0",
                  "product_id": "rhcos-s390x-418.94.202609031320-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@418.94.202609031320?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-x86_64-418.94.202609031320-0",
                "product": {
                  "name": "rhcos-x86_64-418.94.202609031320-0",
                  "product_id": "rhcos-x86_64-418.94.202609031320-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@418.94.202609031320?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-aarch64-418.94.202609031320-0 as a component of Red Hat OpenShift Container Platform 4.18",
          "product_id": "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0"
        },
        "product_reference": "rhcos-aarch64-418.94.202609031320-0",
        "relates_to_product_reference": "9Base-RHOSE-4.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-ppc64le-418.94.202609031320-0 as a component of Red Hat OpenShift Container Platform 4.18",
          "product_id": "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0"
        },
        "product_reference": "rhcos-ppc64le-418.94.202609031320-0",
        "relates_to_product_reference": "9Base-RHOSE-4.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-s390x-418.94.202609031320-0 as a component of Red Hat OpenShift Container Platform 4.18",
          "product_id": "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0"
        },
        "product_reference": "rhcos-s390x-418.94.202609031320-0",
        "relates_to_product_reference": "9Base-RHOSE-4.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-x86_64-418.94.202609031320-0 as a component of Red Hat OpenShift Container Platform 4.18",
          "product_id": "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        },
        "product_reference": "rhcos-x86_64-418.94.202609031320-0",
        "relates_to_product_reference": "9Base-RHOSE-4.18"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-1519",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-03-25T14:01:56.586125+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2451305"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND. A remote attacker could exploit this vulnerability by sending a maliciously crafted DNSSEC-validated zone to a BIND resolver. This could cause the resolver to consume excessive CPU resources, leading to a denial of service (DoS) for legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important. A flaw in BIND allows a remote attacker to cause a Denial of Service by sending a maliciously crafted DNSSEC-validated zone to a BIND resolver. Red Hat systems running BIND configured for DNSSEC validation are affected. Authoritative-only BIND servers are generally not impacted unless configured to perform recursive queries.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1519"
        },
        {
          "category": "external",
          "summary": "RHBZ#2451305",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451305"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1519",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1519"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1519",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1519"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.18.47",
          "url": "https://downloads.isc.org/isc/bind9/9.18.47"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.20.21",
          "url": "https://downloads.isc.org/isc/bind9/9.20.21"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.21.20",
          "url": "https://downloads.isc.org/isc/bind9/9.21.20"
        },
        {
          "category": "external",
          "summary": "https://kb.isc.org/docs/cve-2026-1519",
          "url": "https://kb.isc.org/docs/cve-2026-1519"
        }
      ],
      "release_date": "2026-03-25T13:25:19.802000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable DNSSEC validation on affected BIND resolvers. Alternatively, configure the BIND server as authoritative-only if recursive queries are not required. Disabling DNSSEC validation may reduce the security posture of the DNS resolver. A restart of the BIND service (`named`) is required for these changes to take effect and may temporarily interrupt DNS resolution.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Pavel Kohout"
          ],
          "organization": "Aisle Research"
        }
      ],
      "cve": "CVE-2026-2340",
      "cwe": {
        "id": "CWE-280",
        "name": "Improper Handling of Insufficient Permissions or Privileges"
      },
      "discovery_date": "2026-03-13T12:55:04.465000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447318"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Samba\u2019s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "samba: vfs_worm does not block directory modification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate severity because exploitation requires authenticated write access to a Samba share already configured to permit file creation and modification.\n\nThe flaw affects the vfs_worm module, which provides additional immutability protections for files after a configurable grace period. Due to improper handling of rename operations, a user with existing write permissions could overwrite files that should have become immutable under the WORM policy.\n\nThe vulnerability does not bypass underlying filesystem access controls or grant additional privileges beyond those already assigned to the authenticated user. However, because the primary purpose of the vfs_worm module is to protect file integrity, the ability to modify protected files results in a high integrity impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2340"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447318",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447318"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2340",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2340"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2340",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2340"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.samba.org/show_bug.cgi?id=15997",
          "url": "https://bugzilla.samba.org/show_bug.cgi?id=15997"
        }
      ],
      "release_date": "2026-05-27T10:35:47.805000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        },
        {
          "category": "workaround",
          "details": "Administrators can mitigate this issue by:\n\nSetting read-only permissions on protected files at the underlying filesystem level will prevent modifications.\n\nConfiguring ```worm:grace_period = 0``` (zero or less) in smb.conf will eliminate the writable grace period (will eliminate the window in which the rename can happen), understanding that this may impact workflows requiring multi-step file creation.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "samba: vfs_worm does not block directory modification"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Arad Inbar",
            "Nir Somech",
            "Ben Grinberg"
          ],
          "organization": "DREAM Security Research Team"
        },
        {
          "names": [
            "Michalis Vasileiadis"
          ]
        }
      ],
      "cve": "CVE-2026-3012",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2026-03-13T12:55:02.623000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447319"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Samba\u2019s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "samba: group policy certificate enrollment uses http:// without validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has rated this vulnerability as Important severity. \n\nHowever, exploitation requires several specific non-default conditions to be met. The vulnerable code path is only reachable when Samba Group Policy processing is explicitly enabled using the ```apply group policies = yes``` configuration option and certificate auto-enrollment is configured through Group Policy.\n\nHence, although the vulnerable code is present, it is not exploitable in default RHEL configurations. \n\nIn addition, the attacker must have the ability to intercept or redirect adjacent-network HTTP traffic during certificate retrieval. Because exploitation depends on explicit administrative configuration changes and adjacent-network positioning, Red Hat assesses the attack complexity as High (AC:H).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3012"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447319",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447319"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3012",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3012"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3012",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3012"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.samba.org/show_bug.cgi?id=16003",
          "url": "https://bugzilla.samba.org/show_bug.cgi?id=16003"
        }
      ],
      "release_date": "2026-05-27T09:17:49.862000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        },
        {
          "category": "workaround",
          "details": "Systems are not affected unless Samba Group Policy processing and certificate auto-enrollment are explicitly enabled.\n\nAdministrators can reduce exposure by:\n\nAvoiding unnecessary use of certificate auto-enrollment.\nEnsuring your \"smb.conf\" does not contain a line like ```apply group policies = yes```. If , group policy is not be enabled, the vulnerable code will not run.\n\nIntercepting the HTTP request requires some control over the local network or other devices to intercept or redirect traffic. Some network administrators might assess this as a low risk on their\nnetworks.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "samba: group policy certificate enrollment uses http:// without validation"
    },
    {
      "cve": "CVE-2026-3039",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-19T09:48:19.212000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479767"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending maliciously-constructed packets to BIND servers configured for TKEY-based authentication via GSS-API (Generic Security Service Application Program Interface) tokens. This can lead to excessive memory consumption, resulting in a Denial of Service (DoS) for the affected server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: BIND servers configured for TKEY-based GSS-API authentication are vulnerable to memory exhaustion when processing maliciously-constructed packets. This can lead to a denial of service, specifically impacting Red Hat deployments integrated with Active Directory or Kerberos for DNS where this authentication method is enabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3039"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479767",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479767"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3039",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3039"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3039",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3039"
        }
      ],
      "release_date": "2026-05-21T12:24:11.051000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\nExample:\n```bash\n# Edit /etc/named.conf and remove or comment out lines related to tkey-gssapi-keytab or tkey-gssapi-credential.\n# For example, remove or comment out:\n# key \"gssapi-key\" {\n#     algorithm GSSAPI;\n#     secret \"BASE64_ENCODED_KEY\";\n# };\n#\n# Then reload the named service:\nsystemctl reload named\n```\nReloading the `named` service may cause a brief interruption in DNS resolution.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation"
    },
    {
      "cve": "CVE-2026-3833",
      "cwe": {
        "id": "CWE-178",
        "name": "Improper Handling of Case Sensitivity"
      },
      "discovery_date": "2026-03-09T14:02:09.783000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445763"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is particularly important because it affects the correct enforcement of X.509 nameConstraints, which are specifically designed to limit the authority of subordinate CAs. In GnuTLS, the use of case-sensitive comparisons (memcmp) for dNSName and the domain portion of rfc822Name violates the case-insensitive matching requirements defined in RFC 5280 and RFC 4343. As a result, a constrained subordinate CA can bypass excludedSubtrees or permittedSubtrees restrictions simply by changing the letter casing of a domain in the SAN (e.g., ExAmPlE.CoM vs example.com). Since nameConstraints are often the only mechanism enforcing domain boundaries in delegated PKI hierarchies, this flaw effectively allows a malicious or compromised sub-CA to issue certificates for domains that should be cryptographically prohibited, enabling unauthorized certificate validation and potential TLS impersonation of restricted services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3833"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445763",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3833",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3833"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3833",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3833"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/gnutls/gnutls/-/issues/1803",
          "url": "https://gitlab.com/gnutls/gnutls/-/issues/1803"
        }
      ],
      "release_date": "2026-04-30T17:26:28.969000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison"
    },
    {
      "cve": "CVE-2026-5946",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-05-19T09:57:49.705000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479771"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the bind component, specifically within the `named` daemon. This vulnerability allows a remote attacker to send specially crafted Domain Name System (DNS) messages. These messages, which use unusual classes or meta-classes, can trigger assertion failures in the `named` daemon when processed. Successful exploitation leads to an application level Denial of Service (DoS), making the DNS service unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: BIND: Denial of Service via specially crafted DNS messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is rated as an Important denial of service vulnerability. The `named` daemon is susceptible to crashes when processing specially crafted DNS messages that utilize non-Internet (IN) classes or meta-classes. This can lead to service unavailability if an attacker sends malicious requests targeting recursion, dynamic updates, zone change notifications, or specific record type processing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5946"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479771",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479771"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5946",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5946"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5946",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5946"
        }
      ],
      "release_date": "2026-05-21T12:32:55.602000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: BIND: Denial of Service via specially crafted DNS messages"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "AISLE Research"
          ]
        }
      ],
      "cve": "CVE-2026-6893",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-04-21T02:37:23+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2459963"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut\u0027s legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system\u0027s boot and network behavior.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dracut: dracut: Root code execution via DHCP options command injection",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability in dracut\u0027s legacy DHCP client script (`dhclient-script.sh`) that allows command injection. An attacker on the adjacent network can exploit this by providing specially crafted DHCP options, leading to root code execution within the initramfs. This primarily affects systems configured to use DHCP for network setup during the initial boot phase.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6893"
        },
        {
          "category": "external",
          "summary": "RHBZ#2459963",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6893",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6893"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6893",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6893"
        }
      ],
      "release_date": "2026-06-10T19:39:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that systems configured to obtain network settings via DHCP in the initramfs are only booted on trusted networks. This vulnerability requires an attacker to control a DHCP server on the adjacent network segment. If network configuration via DHCP is not strictly necessary during the initramfs phase, consider using static network configuration.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dracut: dracut: Root code execution via DHCP options command injection"
    },
    {
      "cve": "CVE-2026-10723",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2026-07-21T21:13:55.893000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504560"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: bind9: Incorrect acceptance of NSEC3 records",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in BIND allows an attacker to forge authenticated NXDOMAIN responses for sibling zones due to incorrect validation of child-zone NSEC3 records. Exploitation requires high attack complexity, limiting the immediate risk to Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-10723"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504560",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504560"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-10723",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-10723"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10723",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10723"
        }
      ],
      "release_date": "2026-07-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "bind: bind9: Incorrect acceptance of NSEC3 records"
    },
    {
      "cve": "CVE-2026-11331",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2026-07-21T16:15:37.317000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503721"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND 9, a widely used Domain Name System (DNS) software. A remote attacker could exploit this by sending specially crafted, excessively long DNS queries. This could bypass Response Policy Zone (RPZ) rules, which are designed to block access to malicious domains, and potentially cause the BIND 9 software to crash, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind9: bind: Potential wildcard CNAME RPZ policy bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11331"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503721",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503721"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11331",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11331"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11331",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11331"
        }
      ],
      "release_date": "2026-07-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind9: bind: Potential wildcard CNAME RPZ policy bypass"
    },
    {
      "cve": "CVE-2026-11822",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-06-09T20:01:15.006955+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487258"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in SQLite\u0027s FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed against such a database, an attacker can cause process crashes, memory exhaustion, or achieve arbitrary code execution, potentially compromising the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the SQLite FTS5 full-text search extension can lead to arbitrary code execution or denial of service. Exploitation requires an application to process a specially crafted SQLite database containing malformed FTS5 page data, which could occur if an attacker provides a malicious database to a vulnerable application. This risk is elevated in scenarios where applications handle untrusted SQLite database files.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11822"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487258",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487258"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11822",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11822"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/releaselog/3_53_2.html",
          "url": "https://sqlite.org/releaselog/3_53_2.html"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/src/info/061febcf41ca",
          "url": "https://sqlite.org/src/info/061febcf41ca"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/src/info/4a5ad516ea93",
          "url": "https://sqlite.org/src/info/4a5ad516ea93"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension",
          "url": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension"
        }
      ],
      "release_date": "2026-06-09T19:08:31.019000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data"
    },
    {
      "cve": "CVE-2026-11824",
      "cwe": {
        "id": "CWE-191",
        "name": "Integer Underflow (Wrap or Wraparound)"
      },
      "discovery_date": "2026-06-09T20:02:19.874232+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487269"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in SQLite\u0027s FTS5 full-text search extension can lead to arbitrary code execution or application crashes due to a heap-based buffer overflow. Exploitation requires an attacker to provide a specially crafted SQLite database, which must then be processed by an application compiled with FTS5 support. While requiring user interaction and local access, the potential for full impact on system resources justifies the Important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11824"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487269",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487269"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11824",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11824"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/releaselog/3_53_2.html",
          "url": "https://sqlite.org/releaselog/3_53_2.html"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/src/info/061febcf41ca",
          "url": "https://sqlite.org/src/info/061febcf41ca"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/src/info/4a5ad516ea93",
          "url": "https://sqlite.org/src/info/4a5ad516ea93"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate",
          "url": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate"
        }
      ],
      "release_date": "2026-06-09T19:21:42.603000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5"
    },
    {
      "cve": "CVE-2026-13321",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2026-07-21T19:40:30.464000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504166"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer\u0027s zone.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An attacker controlling any DNSSEC-signed zone can craft NSEC records that span into victim zones, enabling cross-zone cache poisoning with authenticated denial-of-service responses (AD=1).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13321"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504166",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504166"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13321",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13321"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13321",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13321"
        }
      ],
      "release_date": "2026-07-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        },
        {
          "category": "workaround",
          "details": "Disclaimer: The following mitigation notes are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nISC states no workarounds exist. Until patched, restrict the resolver to authorized client networks and deploy separate resolvers per trust zone. Memory hardening and auth controls don\u0027t apply \u2014 this is a DNS protocol logic error using validly-signed records.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field"
    },
    {
      "cve": "CVE-2026-14164",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "discovery_date": "2026-06-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493411"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A double free issue has been identified in libarchive\u0027s RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has assessed this CVE as 7.5 CVSS with Moderate security Impact. This assessment reflects the library\u0027s typical deployment within enterprise software, where libarchive is frequently embedded into automated, network-accessible services that receive and process archives originating from remote sources. In these environments, a specially crafted RAR5 archive may be delivered and processed automatically without requiring direct user interaction, allowing a remote attacker to trigger the vulnerability and cause the affected application or service processing the archive to terminate unexpectedly, resulting in a denial of service.\n\nFrom a standalone library perspective, however, the vulnerable code is only reached when an application opens and processes a crafted RAR5 archive. Evaluating libarchive in isolation, without considering downstream deployment models, the vulnerability more closely aligns with a CVSS score of 5.5-CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (Moderate), reflecting an Attack Vector of Local (AV:L) and User Interaction Required (UI:R). This is because the crafted archive must first be delivered to and processed by a local application before the vulnerable parsing logic is executed. \n\nRed Hat\u0027s assigned score instead reflects the operational deployment of libarchive in automated, network-facing workloads in downstream environment models rather than the standalone library in isolation.\n\n```\n\nThis vulnerability only affects libarchive releases that include support for the RAR5 archive format. RAR5 support was first introduced upstream in libarchive 3.4.0 (https://github.com/libarchive/libarchive/wiki/ReleaseNotes#libarchive-340). Earlier libarchive releases do not contain the vulnerable RAR5 parsing code and are therefore not affected.\n\nRed Hat Enterprise Linux 6, 7, and 8 ship Libarchive versions prior to v3.4.0 that do not include RAR5 support and are therefore not affected.\n\n```",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14164"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493411",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493411"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14164",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14164"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/issues/3069",
          "url": "https://github.com/libarchive/libarchive/issues/3069"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/3071",
          "url": "https://github.com/libarchive/libarchive/pull/3071"
        }
      ],
      "release_date": "2026-05-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the appropriate security update once it becomes available.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Pavel Valena"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-15816",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-06-10T19:21:21+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500889"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates this flaw\u0027s impact as Important. Exploitation requires an attacker-controlled or spoofed DHCP server on the same network segment as a system performing network boot (root=dhcp/netroot=dhcp), and for the DHCP-supplied ROOT_PATH value to fail dracut\u0027s netroot handler resolution -- both fully within an adjacent-network attacker\u0027s control. Reaching the point where the poisoned hook script is actually sourced depends on dracut\u0027s boot-failure handling reinvoking the emergency shell mechanism, which occurs by default when the netroot handler cannot be resolved. This is a separate code path from CVE-2026-6893, which patched modules.d/35network-legacy/dhclient-script.sh but did not modify dracut-lib.sh\u0027s die() function. Systems that do not perform network/PXE boot, or that do not rely on DHCP-supplied ROOT_PATH values, are not exposed to this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15816"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500889",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500889"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15816",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15816"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15816",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15816"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963"
        },
        {
          "category": "external",
          "summary": "https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh",
          "url": "https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh"
        },
        {
          "category": "external",
          "summary": "https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh",
          "url": "https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh"
        }
      ],
      "release_date": "2026-08-05T23:59:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        },
        {
          "category": "workaround",
          "details": "Restrict DHCP server access on networks used for network boot (DHCP snooping, dedicated/trusted provisioning VLANs) until a fix is available.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Shaomin Chen"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2026-16313",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2026-06-01T18:13:24+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2502845"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "sg3_utils versions 1.34 through 1.48 contain a command injection flaw in the export_dev_ids() function of sg_inq. When sg_inq --export processes SCSI device identification data from VPD page 0x83, the SCSI name string designator (type 8) and the ATA vendor-ID subfield are printed without sanitizing embedded control characters. A crafted SCSI/USB device can embed a newline in this field, splitting sg_inq\u0027s udev KEY=VALUE output into two lines and injecting an arbitrary udev property, including REMOVE_CMD. On systems whose default udev rules invoke sg_inq --export for SCSI device identification and act on REMOVE_CMD when a device is removed, this allows a local attacker with physical access to a USB/SCSI port to achieve arbitrary command execution as root simply by disconnecting the crafted device.\n\nExploitation requires physical access to attach the malicious device, consistent with Red Hat\u0027s Physical (AV:P) attack vector scoring. The upstream fix (udev-conforming character escaping for this field) has not yet been included in any tagged sg3_utils release; all Red Hat-shipped versions of sg3_utils in the 1.34-1.48 range are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16313"
        },
        {
          "category": "external",
          "summary": "RHBZ#2502845",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502845"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16313",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16313"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16313",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16313"
        },
        {
          "category": "external",
          "summary": "https://github.com/doug-gilbert/sg3_utils/pull/83",
          "url": "https://github.com/doug-gilbert/sg3_utils/pull/83"
        }
      ],
      "release_date": "2026-06-01T18:13:24+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        },
        {
          "category": "workaround",
          "details": "Remove or comment out the REMOVE_CMD rule from 50-udev-default.rules to prevent command execution on device removal. Alternatively, if automatic SCSI device identification is not required, disable the udev rule that invokes sg_inq --export on device connection.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export"
    },
    {
      "cve": "CVE-2026-29111",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-03-23T22:01:54.593547+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2450505"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-29111"
        },
        {
          "category": "external",
          "summary": "RHBZ#2450505",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450505"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-29111",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-29111"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a",
          "url": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
          "url": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412",
          "url": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd",
          "url": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f",
          "url": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f",
          "url": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69",
          "url": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6",
          "url": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c",
          "url": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8",
          "url": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764",
          "url": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764"
        }
      ],
      "release_date": "2026-03-23T21:03:56.120000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data"
    },
    {
      "cve": "CVE-2026-39821",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-05-22T16:00:52.844126+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480756"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480756",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/767220",
          "url": "https://go.dev/cl/767220"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78760",
          "url": "https://go.dev/issue/78760"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5026",
          "url": "https://pkg.go.dev/vuln/GO-2026-5026"
        }
      ],
      "release_date": "2026-05-22T15:01:21.462000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        },
        {
          "category": "workaround",
          "details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "cve": "CVE-2026-43112",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-05-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467015"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s CIFS (Common Internet File System) client. When the `cifs_sanitize_prepath` function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-bounds read can lead to a system crash, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important out-of-bounds read flaw in the Linux kernel\u0027s CIFS client can lead to a system crash and denial of service. This vulnerability, present in Red Hat Enterprise Linux 8, 9, and 10, and Red Hat In-Vehicle OS 2, can be triggered by processing specially crafted input to the `cifs_sanitize_prepath` function, potentially disrupting system availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43112"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467015",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467015"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43112",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43112"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43112",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43112"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026050625-CVE-2026-43112-f37f@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026050625-CVE-2026-43112-f37f@gregkh/T"
        }
      ],
      "release_date": "2026-05-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T08:01:27+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:77724a6074081531299a1f3136ade3f5491d252a5b502a4e26e82f2c65213b95\n\n      (For s390x architecture)\n      The image digest is\nsha256:be975cbbdf062e07034927f71324a11d2df4321af174e7a6f655db0051e3e749\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:c9a14d5097f91a7d01e068a15f6899c53359a3a3e021d96bb68f11eb3e73072c\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:d4b9d6050c259b416b19a91f3a5b25c0dd48803c272991a723f1a32866da420a\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65851"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, prevent the `cifs` kernel module from loading if CIFS client functionality is not required. This can be achieved by blacklisting the module.\n\nCreate a file named `/etc/modprobe.d/blacklist-cifs.conf` with the following content:\n```\nblacklist cifs\n```\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect.\n```bash\ndracut -f -v\nreboot\n```\nDisabling the `cifs` module will prevent the system from mounting CIFS network shares, which may impact functionality relying on this protocol.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202609031320-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202609031320-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.