Vulnerability-Lookup

RHSA-2026:67148

Vulnerability from csaf_redhat - Published: 2026-09-14 05:14 - Updated: 2026-09-15 08:29

Summary

Red Hat Security Advisory: osbuild-composer security update

Severity

Important

Notes

Topic: An update for osbuild-composer is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-22866

A flaw was found in the Golang crypto/internal/nistec package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Considering how this function is used, this leakage is likely insufficient to recover the private key when P-256 is used in any well-known protocols.

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Fixed 33 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-32281

A flaw was found in Go's `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 33 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-41178

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 33 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-42499

A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1046 - Creation of Immutable Text Using String Concatenation

Affected products

Fixed 33 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-42504

A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 33 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-55677

A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass route-level access controls, leading to unauthorized information disclosure by reading static files.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 33 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

References

52 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:67148	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2344219	external
https://bugzilla.redhat.com/show_bug.cgi?id=2456333	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467809	external
https://bugzilla.redhat.com/show_bug.cgi?id=2484204	external
https://bugzilla.redhat.com/show_bug.cgi?id=2484830	external
https://bugzilla.redhat.com/show_bug.cgi?id=2493622	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-22866	self
https://bugzilla.redhat.com/show_bug.cgi?id=2344219	external
https://www.cve.org/CVERecord?id=CVE-2025-22866	external
https://nvd.nist.gov/vuln/detail/CVE-2025-22866	external
https://go.dev/cl/643735	external
https://go.dev/issue/71383	external
https://groups.google.com/g/golang-announce/c/xU1…	external
https://pkg.go.dev/vuln/GO-2025-3447	external
https://access.redhat.com/security/cve/CVE-2026-32281	self
https://bugzilla.redhat.com/show_bug.cgi?id=2456333	external
https://www.cve.org/CVERecord?id=CVE-2026-32281	external
https://nvd.nist.gov/vuln/detail/CVE-2026-32281	external
https://go.dev/cl/758061	external
https://go.dev/issue/78281	external
https://groups.google.com/g/golang-announce/c/0uY…	external
https://pkg.go.dev/vuln/GO-2026-4946	external
https://access.redhat.com/security/cve/CVE-2026-41178	self
https://bugzilla.redhat.com/show_bug.cgi?id=2484830	external
https://www.cve.org/CVERecord?id=CVE-2026-41178	external
https://nvd.nist.gov/vuln/detail/CVE-2026-41178	external
https://github.com/open-telemetry/opentelemetry-g…	external
https://github.com/open-telemetry/opentelemetry-g…	external
https://access.redhat.com/security/cve/CVE-2026-42499	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467809	external
https://www.cve.org/CVERecord?id=CVE-2026-42499	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42499	external
https://go.dev/cl/771520	external
https://go.dev/issue/78987	external
https://groups.google.com/g/golang-announce/c/qcC…	external
https://pkg.go.dev/vuln/GO-2026-4977	external
https://access.redhat.com/security/cve/CVE-2026-42504	self
https://bugzilla.redhat.com/show_bug.cgi?id=2484204	external
https://www.cve.org/CVERecord?id=CVE-2026-42504	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42504	external
https://go.dev/cl/774481	external
https://go.dev/issue/79217	external
https://groups.google.com/g/golang-announce/c/tKs…	external
https://pkg.go.dev/vuln/GO-2026-5038	external
https://access.redhat.com/security/cve/CVE-2026-55677	self
https://bugzilla.redhat.com/show_bug.cgi?id=2493622	external
https://www.cve.org/CVERecord?id=CVE-2026-55677	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55677	external
https://github.com/labstack/echo/security/advisor…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for osbuild-composer is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.\n\nSecurity Fix(es):\n\n* crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)\n\n* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)\n\n* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)\n\n* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)\n\n* github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)\n\n* github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:67148",
        "url": "https://access.redhat.com/errata/RHSA-2026:67148"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2344219",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344219"
      },
      {
        "category": "external",
        "summary": "2456333",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
      },
      {
        "category": "external",
        "summary": "2467809",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
      },
      {
        "category": "external",
        "summary": "2484204",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
      },
      {
        "category": "external",
        "summary": "2484830",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484830"
      },
      {
        "category": "external",
        "summary": "2493622",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493622"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67148.json"
      }
    ],
    "title": "Red Hat Security Advisory: osbuild-composer security update",
    "tracking": {
      "current_release_date": "2026-09-15T08:29:57+00:00",
      "generator": {
        "date": "2026-09-15T08:29:57+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.21"
        }
      },
      "id": "RHSA-2026:67148",
      "initial_release_date": "2026-09-14T05:14:03+00:00",
      "revision_history": [
        {
          "date": "2026-09-14T05:14:03+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-14T05:14:03+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-15T08:29:57+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "osbuild-composer-0:101.5-3.el8_10.s390x",
                "product": {
                  "name": "osbuild-composer-0:101.5-3.el8_10.s390x",
                  "product_id": "osbuild-composer-0:101.5-3.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer@101.5-3.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-0:101.5-3.el8_10.s390x",
                "product": {
                  "name": "osbuild-composer-core-0:101.5-3.el8_10.s390x",
                  "product_id": "osbuild-composer-core-0:101.5-3.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core@101.5-3.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-0:101.5-3.el8_10.s390x",
                "product": {
                  "name": "osbuild-composer-worker-0:101.5-3.el8_10.s390x",
                  "product_id": "osbuild-composer-worker-0:101.5-3.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker@101.5-3.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
                "product": {
                  "name": "osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
                  "product_id": "osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debugsource@101.5-3.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
                "product": {
                  "name": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
                  "product_id": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@101.5-3.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
                "product": {
                  "name": "osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
                  "product_id": "osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@101.5-3.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
                "product": {
                  "name": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
                  "product_id": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@101.5-3.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
                "product": {
                  "name": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
                  "product_id": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@101.5-3.el8_10?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "osbuild-composer-0:101.5-3.el8_10.src",
                "product": {
                  "name": "osbuild-composer-0:101.5-3.el8_10.src",
                  "product_id": "osbuild-composer-0:101.5-3.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer@101.5-3.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "osbuild-composer-0:101.5-3.el8_10.aarch64",
                "product": {
                  "name": "osbuild-composer-0:101.5-3.el8_10.aarch64",
                  "product_id": "osbuild-composer-0:101.5-3.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer@101.5-3.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-0:101.5-3.el8_10.aarch64",
                "product": {
                  "name": "osbuild-composer-core-0:101.5-3.el8_10.aarch64",
                  "product_id": "osbuild-composer-core-0:101.5-3.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core@101.5-3.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
                "product": {
                  "name": "osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
                  "product_id": "osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker@101.5-3.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
                "product": {
                  "name": "osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
                  "product_id": "osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debugsource@101.5-3.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
                "product": {
                  "name": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
                  "product_id": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@101.5-3.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
                "product": {
                  "name": "osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
                  "product_id": "osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@101.5-3.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
                "product": {
                  "name": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
                  "product_id": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@101.5-3.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
                "product": {
                  "name": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
                  "product_id": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@101.5-3.el8_10?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "osbuild-composer-0:101.5-3.el8_10.ppc64le",
                "product": {
                  "name": "osbuild-composer-0:101.5-3.el8_10.ppc64le",
                  "product_id": "osbuild-composer-0:101.5-3.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer@101.5-3.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
                "product": {
                  "name": "osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
                  "product_id": "osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core@101.5-3.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
                "product": {
                  "name": "osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
                  "product_id": "osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker@101.5-3.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
                "product": {
                  "name": "osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
                  "product_id": "osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debugsource@101.5-3.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
                "product": {
                  "name": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
                  "product_id": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@101.5-3.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
                "product": {
                  "name": "osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
                  "product_id": "osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@101.5-3.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
                "product": {
                  "name": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
                  "product_id": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@101.5-3.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
                "product": {
                  "name": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
                  "product_id": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@101.5-3.el8_10?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "osbuild-composer-0:101.5-3.el8_10.x86_64",
                "product": {
                  "name": "osbuild-composer-0:101.5-3.el8_10.x86_64",
                  "product_id": "osbuild-composer-0:101.5-3.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer@101.5-3.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-0:101.5-3.el8_10.x86_64",
                "product": {
                  "name": "osbuild-composer-core-0:101.5-3.el8_10.x86_64",
                  "product_id": "osbuild-composer-core-0:101.5-3.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core@101.5-3.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
                "product": {
                  "name": "osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
                  "product_id": "osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker@101.5-3.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
                "product": {
                  "name": "osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
                  "product_id": "osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debugsource@101.5-3.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
                "product": {
                  "name": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
                  "product_id": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@101.5-3.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
                "product": {
                  "name": "osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
                  "product_id": "osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@101.5-3.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
                "product": {
                  "name": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
                  "product_id": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@101.5-3.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64",
                "product": {
                  "name": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64",
                  "product_id": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@101.5-3.el8_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-0:101.5-3.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64"
        },
        "product_reference": "osbuild-composer-0:101.5-3.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-0:101.5-3.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le"
        },
        "product_reference": "osbuild-composer-0:101.5-3.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-0:101.5-3.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x"
        },
        "product_reference": "osbuild-composer-0:101.5-3.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-0:101.5-3.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src"
        },
        "product_reference": "osbuild-composer-0:101.5-3.el8_10.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-0:101.5-3.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64"
        },
        "product_reference": "osbuild-composer-0:101.5-3.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-0:101.5-3.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64"
        },
        "product_reference": "osbuild-composer-core-0:101.5-3.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-0:101.5-3.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le"
        },
        "product_reference": "osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-0:101.5-3.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x"
        },
        "product_reference": "osbuild-composer-core-0:101.5-3.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-0:101.5-3.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64"
        },
        "product_reference": "osbuild-composer-core-0:101.5-3.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64"
        },
        "product_reference": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le"
        },
        "product_reference": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x"
        },
        "product_reference": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64"
        },
        "product_reference": "osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64"
        },
        "product_reference": "osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le"
        },
        "product_reference": "osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x"
        },
        "product_reference": "osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64"
        },
        "product_reference": "osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64"
        },
        "product_reference": "osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le"
        },
        "product_reference": "osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debugsource-0:101.5-3.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x"
        },
        "product_reference": "osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64"
        },
        "product_reference": "osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64"
        },
        "product_reference": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le"
        },
        "product_reference": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x"
        },
        "product_reference": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64"
        },
        "product_reference": "osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-0:101.5-3.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64"
        },
        "product_reference": "osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-0:101.5-3.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le"
        },
        "product_reference": "osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-0:101.5-3.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x"
        },
        "product_reference": "osbuild-composer-worker-0:101.5-3.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-0:101.5-3.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64"
        },
        "product_reference": "osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64"
        },
        "product_reference": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le"
        },
        "product_reference": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x"
        },
        "product_reference": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
        },
        "product_reference": "osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-22866",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2025-02-06T17:00:56.155646+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2344219"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Golang crypto/internal/nistec package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Considering how this function is used, this leakage is likely insufficient to recover the private key when P-256 is used in any well-known protocols.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-22866"
        },
        {
          "category": "external",
          "summary": "RHBZ#2344219",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344219"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-22866",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-22866"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-22866",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22866"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/643735",
          "url": "https://go.dev/cl/643735"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/71383",
          "url": "https://go.dev/issue/71383"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k",
          "url": "https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-3447",
          "url": "https://pkg.go.dev/vuln/GO-2025-3447"
        }
      ],
      "release_date": "2025-02-06T16:54:10.252000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-14T05:14:03+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67148"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec"
    },
    {
      "cve": "CVE-2026-32281",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-04-08T02:01:00.930989+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456333"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw occurs during the validation of otherwise trusted certificate chains that contain a large number of policy mappings, leading to excessive resource consumption. Exploitation requires an attacker to present a specially crafted, yet trusted, certificate chain which would require the attacker has already compromised a trusted certificate root. Red Hat continuously monitors certificate authorities and curates the set which is trusted by default for Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32281"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456333",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32281",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/758061",
          "url": "https://go.dev/cl/758061"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78281",
          "url": "https://go.dev/issue/78281"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4946",
          "url": "https://pkg.go.dev/vuln/GO-2026-4946"
        }
      ],
      "release_date": "2026-04-08T01:06:58.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-14T05:14:03+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67148"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "cve": "CVE-2026-41178",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-04T16:01:10.300537+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484830"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in OpenTelemetry-Go, affecting versions 1.41.0 and 1.43.0. An attacker can exploit this flaw by sending oversized baggage headers, causing the `Parse` function to process invalid inputs and log errors, which can lead to resource exhaustion and service disruption in Red Hat products utilizing these affected OpenTelemetry-Go versions. The impact is considered Important due to the potential for remote, unauthenticated denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484830",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484830"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41178",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41178",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "https://github.com/open-telemetry/opentelemetry-go/pull/7880",
          "url": "https://github.com/open-telemetry/opentelemetry-go/pull/7880"
        },
        {
          "category": "external",
          "summary": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835",
          "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
        }
      ],
      "release_date": "2026-06-04T14:38:23.707000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-14T05:14:03+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67148"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers"
    },
    {
      "cve": "CVE-2026-42499",
      "cwe": {
        "id": "CWE-1046",
        "name": "Creation of Immutable Text Using String Concatenation"
      },
      "discovery_date": "2026-05-07T20:00:51.685602+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467809"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42499"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467809",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/771520",
          "url": "https://go.dev/cl/771520"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78987",
          "url": "https://go.dev/issue/78987"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4977",
          "url": "https://pkg.go.dev/vuln/GO-2026-4977"
        }
      ],
      "release_date": "2026-05-07T19:41:18.615000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-14T05:14:03+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67148"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "cve": "CVE-2026-42504",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-06-02T23:01:00.320527+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484204"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484204",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42504",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/774481",
          "url": "https://go.dev/cl/774481"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79217",
          "url": "https://go.dev/issue/79217"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5038",
          "url": "https://pkg.go.dev/vuln/GO-2026-5038"
        }
      ],
      "release_date": "2026-06-02T22:01:37.219000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-14T05:14:03+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67148"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "cve": "CVE-2026-55677",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-06-26T17:01:45.110038+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493622"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass route-level access controls, leading to unauthorized information disclosure by reading static files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important information disclosure flaw in the Echo web framework. The discrepancy in URL path decoding between the router and static file handler allows an unauthenticated attacker to bypass access controls and read arbitrary static files. This could lead to the exposure of sensitive data hosted on affected Red Hat products utilizing the Echo framework for serving static content.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55677"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493622",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493622"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55677",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55677"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55677",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55677"
        },
        {
          "category": "external",
          "summary": "https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq",
          "url": "https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq"
        }
      ],
      "release_date": "2026-06-26T16:15:55.633000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-14T05:14:03+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67148"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-0:101.5-3.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:101.5-3.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy"
    }
  ]
}

CVE-2025-22866 (GCVE-0-2025-22866)

Vulnerability from cvelistv5 – Published: 2025-02-06 16:54 – Updated: 2025-02-21 18:03

Title

Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

Summary

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.

Severity

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-10 20:40 UTC

CWE

CWE-208 - Observable Timing Discrepancy

Assigner

Go Google root

References

5 references

URL	Tags
https://go.dev/cl/643735
https://go.dev/issue/71383
https://groups.google.com/g/golang-announce/c/xU1…
https://pkg.go.dev/vuln/GO-2025-3447
https://security.netapp.com/advisory/ntap-2025022…

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/internal/nistec	Affected: 0 , < 1.22.12 (semver) Affected: 1.23.0-0 , < 1.23.6 (semver) Affected: 1.24.0-0 , < 1.24.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22866",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-10T20:40:17.232803Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T14:47:25.778Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-02-21T18:03:36.215Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250221-0002/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/internal/nistec",
          "product": "crypto/internal/nistec",
          "programRoutines": [
            {
              "name": "p256NegCond"
            },
            {
              "name": "P256Point.ScalarBaseMult"
            },
            {
              "name": "P256Point.ScalarMult"
            },
            {
              "name": "P256Point.SetBytes"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.22.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.23.6",
              "status": "affected",
              "version": "1.23.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.24.0-rc.3",
              "status": "affected",
              "version": "1.24.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-208: Observable Timing Discrepancy",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-06T16:54:10.252Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/643735"
        },
        {
          "url": "https://go.dev/issue/71383"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2025-3447"
        }
      ],
      "title": "Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-22866",
    "datePublished": "2025-02-06T16:54:10.252Z",
    "dateReserved": "2025-01-08T19:11:42.834Z",
    "dateUpdated": "2025-02-21T18:03:36.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-32281 (GCVE-0-2026-32281)

Vulnerability from cvelistv5 – Published: 2026-04-08 01:06 – Updated: 2026-04-13 18:19

Title

Inefficient policy validation in crypto/x509

Summary

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-13 17:52 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/cl/758061
https://go.dev/issue/78281
https://groups.google.com/g/golang-announce/c/0uY…
https://pkg.go.dev/vuln/GO-2026-4946

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/x509	Affected: 0 , < 1.25.9 (semver) Affected: 1.26.0-0 , < 1.26.2 (semver)

Credits

Jakub Ciolek - https://ciolek.dev

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-32281",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-13T17:52:37.734298Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-13T18:19:44.779Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/x509",
          "product": "crypto/x509",
          "programRoutines": [
            {
              "name": "policiesValid"
            },
            {
              "name": "Certificate.Verify"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.2",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jakub Ciolek - https://ciolek.dev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T01:06:58.354Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/758061"
        },
        {
          "url": "https://go.dev/issue/78281"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4946"
        }
      ],
      "title": "Inefficient policy validation in crypto/x509"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-32281",
    "datePublished": "2026-04-08T01:06:58.354Z",
    "dateReserved": "2026-03-11T16:38:46.556Z",
    "dateUpdated": "2026-04-13T18:19:44.779Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41178 (GCVE-0-2026-41178)

Vulnerability from cvelistv5 – Published: 2026-06-04 14:38 – Updated: 2026-06-04 15:46

Title

OpenTelemetry-Go's baggage parsing no longer caps raw header length

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-04 15:46 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
open-telemetry	go.opentelemetry.io/otel/baggage	Affected: = 1.41.0 Affected: = 1.43.0
open-telemetry	go.opentelemetry.io/otel/propagation	Affected: = 1.41.0 Affected: = 1.43.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41178",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T15:46:06.715583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-04T15:46:11.923Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go.opentelemetry.io/otel/baggage",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.41.0"
            },
            {
              "status": "affected",
              "version": "= 1.43.0"
            }
          ]
        },
        {
          "product": "go.opentelemetry.io/otel/propagation",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.41.0"
            },
            {
              "status": "affected",
              "version": "= 1.43.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T14:38:23.707Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/pull/7880",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/pull/7880"
        }
      ],
      "source": {
        "advisory": "GHSA-5wrp-cwcj-q835",
        "discovery": "UNKNOWN"
      },
      "title": "OpenTelemetry-Go\u0027s baggage parsing no longer caps raw header length"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41178",
    "datePublished": "2026-06-04T14:38:23.707Z",
    "dateReserved": "2026-04-17T16:34:45.526Z",
    "dateUpdated": "2026-06-04T15:46:11.923Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42499 (GCVE-0-2026-42499)

Vulnerability from cvelistv5 – Published: 2026-05-07 19:41 – Updated: 2026-09-14 12:04

Title

Quadratic string concatenation in consumePhrase in net/mail

Summary

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-08 16:55 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity
CWE-1046 - Creation of Immutable Text Using String Concatenation

Assigner

Go Google root

References

94 references

URL	Tags
https://go.dev/issue/78987
https://go.dev/cl/771520
https://groups.google.com/g/golang-announce/c/qcC…
https://pkg.go.dev/vuln/GO-2026-4977
https://access.redhat.com/security/cve/CVE-2026-42499	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2467809	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:50319	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59830	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56785	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56910	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56852	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60018	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57482	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54552	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:50336	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57845	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57914	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:63636	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49702	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65335	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66327	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:63332	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22120	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:63022	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65534	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65116	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65895	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:64818	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:63163	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22112	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62407	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:67148	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61253	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62754	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57649	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62753	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49712	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51112	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65336	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62803	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22121	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62406	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65886	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65117	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65153	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54531	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34364	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56340	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47952	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:50843	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51033	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59467	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66022	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:43692	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36319	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36625	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36754	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33574	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17713	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17714	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41928	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:50300	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:43038	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42644	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60520	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59833	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56789	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56912	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56854	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60023	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57487	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54555	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54583	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54602	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62260	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33120	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33123	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33142	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33150	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54287	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54284	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54286	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54285	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54274	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54283	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41031	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42146	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:43052	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42796	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41066	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40262	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36797	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57194	vendor-advisoryx_refsource_REDHAT

Impacted products

180 products

Vendor	Product	Version
Go standard library	net/mail	Affected: 0 , < 1.25.10 (semver) Affected: 1.26.0-0 , < 1.26.3 (semver)
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	Unaffected: 0:2.5.10-7.el8ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.5::el8
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 9	Unaffected: 0:2.6.17-2.el9ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.5::el9
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9	Unaffected: 0:2.6.17-2.el9ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.6::el9
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:1.26.3-4.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:10.2.6-28.el10_2.5 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 2:1.43.1-5.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 2:1.22.2-5.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.152.1-2.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:52.1-1.el10_2.2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:165.1-3.el10_2.2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:1.26.5-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:2.21.0-3.el10_0.4 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:134.1-12.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260518131104.a3795dee , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:9.2.10-33.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260901110702.afee755d , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.26.3-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:10.2.6-23.el9_8.3 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.152.1-2.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:165.1-4.el9_8.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:52.1-1.el9_8.2 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:1.26.5-1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:76.1-9.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:1.26.5-1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:101.3-4.el9_4.6 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:1.26.5-1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:10.2.6-22.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:132.2-12.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:2.21.0-7.el9_6.1 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 0:1.25.5-34.rhaos4.12.git6120b13.el8 , < * (rpm) cpe:/a:redhat:openshift:4.12::el8
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 0:4.12.0-202608131627.p2.g0e18cfc.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.12::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 0:1.27.8-19.rhaos4.14.gitcea2db1.el8 , < * (rpm) cpe:/a:redhat:openshift:4.14::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 0:4.14.0-202608131802.p2.g9a7820e.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.14::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 0:1.28.11-14.rhaos4.15.gitf722b2f.el8 , < * (rpm) cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 0:4.15.0-202608131733.p2.g5cb2ef4.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 0:4.15.0-202608131733.p2.g8231637.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 0:4.15.0-202608131733.p2.gfd77d92.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 0:4.15.0-202608131733.p2.g5638728.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 0:4.15.0-202608131733.p2.gfc50272.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:1.29.13-12.rhaos4.16.git979a5e6.el8 , < * (rpm) cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:4.16.0-202608111505.p2.g41c4e9b.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:4.16.0-202608111505.p2.g6f88b58.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:4.16.0-202608111505.p2.ga53e9de.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:4.16.0-202608111505.p2.ga3ebdc0.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:4.16.0-202608111505.p2.g26b43df.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 0:1.30.14-11.rhaos4.17.git1e2a16d.el8 , < * (rpm) cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 0:4.17.0-202608132055.p2.g4e295fa.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 0:4.17.0-202608201812.p2.g7189593.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 0:4.17.0-202608122146.p2.g144bace.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 0:4.17.0-202608122146.p2.g5bcfbfd.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 0:4.17.0-202608122146.p2.g8ce997d.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 0:1.31.13-11.rhaos4.18.git817a650.el9 , < * (rpm) cpe:/a:redhat:openshift:4.18::el8
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 0:4.18.0-202608132034.p2.g91c2408.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.18::el8
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 0:4.18.0-202608132034.p2.g6febe61.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.18::el8
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 0:4.18.0-202608121933.p2.gc395190.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.18::el8
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 0:4.18.0-202608121933.p2.g9795abd.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.18::el8
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 0:4.18.0-202608121933.p2.g6ea2356.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.18::el8
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 0:4.18.54-202608211117.p0.g8eb6c29.assembly.4.18.54.el9 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 0:1.32.13-9.rhaos4.19.git2100f27.el9 , < * (rpm) cpe:/a:redhat:openshift:4.19::el8
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 0:4.19.0-202608111604.p2.g63adf01.assembly.stream.el9 , < * (rpm) cpe:/a:redhat:openshift:4.19::el8
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 0:4.19.0-202608111604.p2.gb2a93a6.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.19::el8
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 0:4.19.0-202608111604.p2.g425c1c5.assembly.stream.el9 , < * (rpm) cpe:/a:redhat:openshift:4.19::el8
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 0:4.19.46-202609041024.p0.g59e34c7.assembly.4.19.46.el9 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	Cert Manager support for Red Hat OpenShift release 1.19	Unaffected: 1786613805 , < * (rpm) cpe:/a:redhat:cert_manager:1.19::el9
Red Hat	Logging for Red Hat OpenShift 6	Unaffected: 1785419067 , < * (rpm) cpe:/a:redhat:logging:6.0::el9
Red Hat	Logging for Red Hat OpenShift 6.2	Unaffected: 1784748010 , < * (rpm) cpe:/a:redhat:logging:6.2::el9
Red Hat	Logging Subsystem for Red Hat OpenShift 6.4	Unaffected: 1782405469 , < * (rpm) cpe:/a:redhat:logging:6.4::el9
Red Hat	Logging Subsystem for Red Hat OpenShift 6.5	Unaffected: 1786645248 , < * (rpm) cpe:/a:redhat:logging:6.5::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786911952 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786912006 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	OpenShift API for Data Protection 1.3	Unaffected: 1785177357 , < * (rpm) cpe:/a:redhat:openshift_api_data_protection:1.3::el9
Red Hat	OpenShift API for Data Protection 1.4	Unaffected: 1786946116 , < * (rpm) cpe:/a:redhat:openshift_api_data_protection:1.4::el9
Red Hat	OpenShift API for Data Protection 1.5	Unaffected: 1788860461 , < * (rpm) cpe:/a:redhat:openshift_api_data_protection:1.5::el9
Red Hat	OpenShift API for Data Protection 1.6	Unaffected: 1784058822 , < * (rpm) cpe:/a:redhat:openshift_api_data_protection:1.6::el9
Red Hat	Red Hat Advanced Cluster Security 4.9	Unaffected: 1783357116 , < * (rpm) cpe:/a:redhat:advanced_cluster_security:4.9::el8
Red Hat	Red Hat Advanced Cluster Security for Kubernetes 4.10	Unaffected: 1783357140 , < * (rpm) cpe:/a:redhat:advanced_cluster_security:4.10::el8
Red Hat	Red Hat Developer Hub 1.10	Unaffected: 1783447707 , < * (rpm) cpe:/a:redhat:rhdh:1.10::el9
Red Hat	Red Hat Developer Hub 1.9	Unaffected: 1782767215 , < * (rpm) cpe:/a:redhat:rhdh:1.9::el9
Red Hat	Red Hat Hardened Images	Unaffected: 1.25.10-2.2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 1.26.3-2.2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Migration Toolkit 1.8	Unaffected: 1783953372 , < * (rpm) cpe:/a:redhat:rhmt:1.8::el8
Red Hat	Red Hat Migration Toolkit for Applications 8.1	Unaffected: 1785171639 , < * (rpm) cpe:/a:redhat:migration_toolkit_applications:8.1::el9
Red Hat	Red Hat Migration Toolkit for Applications 8.2	Unaffected: 1784211378 , < * (rpm) cpe:/a:redhat:migration_toolkit_applications:8.2::el9
Red Hat	Red Hat OpenShift AI 2.25	Unaffected: 1783544461 , < * (rpm) cpe:/a:redhat:openshift_ai:2.25::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787102977 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1786611759 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787562200 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 1786752886 , < * (rpm) cpe:/a:redhat:openshift:4.12::el9
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 1787002807 , < * (rpm) cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 1787055135 , < * (rpm) cpe:/a:redhat:openshift:4.15::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 1786788280 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 1787549445 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 1786754308 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 1786489910 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	Red Hat OpenShift Container Platform 4.20	Unaffected: 1786494900 , < * (rpm) cpe:/a:redhat:openshift:4.20::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 1786496647 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 1786573075 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.30	Unaffected: 1787756267 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.30::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.30	Unaffected: 1787756799 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.30::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1782222217 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1782223341 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1782296193 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1782222607 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1782222163 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1782223138 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1782222394 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1782222451 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1782226178 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1782224487 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1782303211 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1782224541 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1782223045 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1782222366 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1782310747 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1782222038 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Workload Availability 0.12	Unaffected: 1785202723 , < * (rpm) cpe:/a:redhat:workload_availability_nhc:0.12::el9
Red Hat	Red Hat OpenShift Workload Availability 0.13	Unaffected: 1785203036 , < * (rpm) cpe:/a:redhat:workload_availability_snr:0.13::el9
Red Hat	Red Hat OpenShift Workload Availability 0.3	Unaffected: 1785203474 , < * (rpm) cpe:/a:redhat:workload_availability_sbr:0.3::el9
Red Hat	Red Hat OpenShift Workload Availability 0.7	Unaffected: 1785203508 , < * (rpm) cpe:/a:redhat:workload_availability_mdr:0.7::el9
Red Hat	Red Hat OpenShift Workload Availability 0.8	Unaffected: 1785203079 , < * (rpm) cpe:/a:redhat:workload_availability_far:0.8::el9
Red Hat	Red Hat OpenShift Workload Availability 5.7	Unaffected: 1785202847 , < * (rpm) cpe:/a:redhat:workload_availability_nmo:5.7::el9
Red Hat	Red Hat Quay 3.10	Unaffected: 1783750447 , < * (rpm) cpe:/a:redhat:quay:3.10::el8
Red Hat	Red Hat Quay 3.12	Unaffected: 1783751865 , < * (rpm) Unaffected: 1784353904 , < * (rpm) cpe:/a:redhat:quay:3.12::el8
Red Hat	Red Hat Quay 3.15	Unaffected: 1784351966 , < * (rpm) cpe:/a:redhat:quay:3.15::el8
Red Hat	Red Hat Quay 3.16	Unaffected: 1783955846 , < * (rpm) cpe:/a:redhat:quay:3.16::el9
Red Hat	Red Hat Quay 3.9	Unaffected: 1784125838 , < * (rpm) cpe:/a:redhat:quay:3.9::el8
Red Hat	Red Hat Trusted Artifact Signer 1.4	Unaffected: 4-1.4.2 , < * (rpm) Unaffected: 4-1.4.3 , < * (rpm) cpe:/a:redhat:trusted_artifact_signer:1.4::el9
Red Hat	Assisted Installer for Red Hat OpenShift Container Platform 2	cpe:/a:redhat:assisted_installer:2
Red Hat	Confidential Compute Attestation	cpe:/a:redhat:confidential_compute_attestation:1
Red Hat	Cryostat 4	cpe:/a:redhat:cryostat:4
Red Hat	Custom Metric Autoscaler operator for Red Hat Openshift	cpe:/a:redhat:openshift_custom_metrics_autoscaler:2
Red Hat	ExternalDNS Operator	cpe:/a:redhat:ext_dns_optr:1
Red Hat	External Secrets Operator for Red Hat OpenShift	cpe:/a:redhat:external_secrets_operator:1
Red Hat	File Integrity Operator	cpe:/a:redhat:openshift_file_integrity_operator:1
Red Hat	Gatekeeper 3	cpe:/a:redhat:gatekeeper:3
Red Hat	Logical Volume Manager Storage	cpe:/a:redhat:lvms:4
Red Hat	Multiarch Tuning Operator	cpe:/a:redhat:multiarch_tuning_operator
Red Hat	Multicluster Engine for Kubernetes	cpe:/a:redhat:multicluster_engine
Red Hat	Multicluster Global Hub	cpe:/a:redhat:multicluster_globalhub
Red Hat	Network Observability Operator	cpe:/a:redhat:network_observ_optr:1
Red Hat	OpenShift Developer Tools and Services	cpe:/a:redhat:ocp_tools
Red Hat	OpenShift Lightspeed	cpe:/a:redhat:openshift_lightspeed
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	OpenShift Serverless	cpe:/a:redhat:serverless:1
Red Hat	OpenShift Service Mesh 2	cpe:/a:redhat:service_mesh:2
Red Hat	OpenShift Service Mesh 3	cpe:/a:redhat:service_mesh:3
Red Hat	Power monitoring for Red Hat OpenShift	cpe:/a:redhat:openshift_power_monitoring
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	cpe:/a:redhat:acm:2
Red Hat	Red Hat Ansible Automation Platform 2	cpe:/a:redhat:ansible_automation_platform:2
Red Hat	Red Hat Ceph Storage 5	cpe:/a:redhat:ceph_storage:5
Red Hat	Red Hat Ceph Storage 6	cpe:/a:redhat:ceph_storage:6
Red Hat	Red Hat Ceph Storage 9	cpe:/a:redhat:ceph_storage:9
Red Hat	Red Hat Certification Program for Red Hat Enterprise Linux 9	cpe:/a:redhat:certifications:9
Red Hat	Red Hat Edge Manager 1	cpe:/a:redhat:edge_manager:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	cpe:/a:redhat:enterprise_linux_ai:3
Red Hat	Red Hat Lightspeed for Runtimes Operator	cpe:/a:redhat:lightspeed_for_runtimes:1
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift Cluster Manager CLI	cpe:/a:redhat:openshift_cluster_manager_cli:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat Openshift Data Foundation 4	cpe:/a:redhat:openshift_data_foundation:4
Red Hat	Red Hat OpenShift Dev Workspaces Operator	cpe:/a:redhat:devworkspace
Red Hat	Red Hat OpenShift distributed tracing 3	cpe:/a:redhat:openshift_distributed_tracing:3
Red Hat	Red Hat OpenShift for Windows Containers	cpe:/a:redhat:windows_machine_config
Red Hat	Red Hat OpenShift GitOps	cpe:/a:redhat:openshift_gitops:1
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenStack Platform 16.2	cpe:/a:redhat:openstack:16.2
Red Hat	Red Hat OpenStack Platform 17.1	cpe:/a:redhat:openstack:17.1
Red Hat	Red Hat OpenStack Platform 18.0	cpe:/a:redhat:openstack:18.0
Red Hat	Red Hat Quay 3	cpe:/a:redhat:quay:3
Red Hat	Red Hat Satellite 6	cpe:/a:redhat:satellite:6
Red Hat	Red Hat Service Interconnect 1	cpe:/a:redhat:service_interconnect:1
Red Hat	Red Hat Service Interconnect 2	cpe:/a:redhat:service_interconnect:2
Red Hat	Security Profiles Operator	cpe:/a:redhat:openshift_security_profiles_operator:1
Red Hat	Zero Trust Workload Identity Manager	cpe:/a:redhat:zero_trust_workload_identity_manager:1
Red Hat	Zero Trust Workload Identity Manager - Tech Preview	cpe:/a:redhat:zero_trust_workload_identity_manager:0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42499",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-08T16:55:28.873015Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-08T21:29:59.662Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.5::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "automation-gateway-proxy",
            "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.10-7.el8ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "automation-gateway-proxy",
            "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.6.17-2.el9ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "automation-gateway-proxy",
            "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.6.17-2.el9ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.3-4.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:10.2.6-28.el10_2.5",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "buildah",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "2:1.43.1-5.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "skopeo",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "2:1.22.2-5.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.152.1-2.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "image-builder",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:52.1-1.el10_2.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:165.1-3.el10_2.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "ignition",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.21.0-3.el10_0.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:134.1-12.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "go-toolset:rhel8",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260518131104.a3795dee",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:9.2.10-33.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "container-tools:rhel8",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260901110702.afee755d",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.3-1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:10.2.6-23.el9_8.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.152.1-2.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:165.1-4.el9_8.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "image-builder",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:52.1-1.el9_8.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:76.1-9.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:101.3-4.el9_4.6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:10.2.6-22.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:132.2-12.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "ignition",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.21.0-7.el9_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.25.5-34.rhaos4.12.git6120b13.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift",
            "product": "Red Hat OpenShift Container Platform 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.12.0-202608131627.p2.g0e18cfc.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.14::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.27.8-19.rhaos4.14.gitcea2db1.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.14::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-aws-ecr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.14.0-202608131802.p2.g9a7820e.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.28.11-14.rhaos4.15.gitf722b2f.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.15.0-202608131733.p2.g5cb2ef4.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-clients",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.15.0-202608131733.p2.g8231637.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-aws-ecr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.15.0-202608131733.p2.gfd77d92.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-azure-acr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.15.0-202608131733.p2.g5638728.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-gcp-gcr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.15.0-202608131733.p2.gfc50272.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.29.13-12.rhaos4.16.git979a5e6.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.16.0-202608111505.p2.g41c4e9b.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-clients",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.16.0-202608111505.p2.g6f88b58.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-aws-ecr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.16.0-202608111505.p2.ga53e9de.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-azure-acr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.16.0-202608111505.p2.ga3ebdc0.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-gcp-gcr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.16.0-202608111505.p2.g26b43df.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "microshift",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.30.14-11.rhaos4.17.git1e2a16d.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.17.0-202608132055.p2.g4e295fa.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-clients",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.17.0-202608201812.p2.g7189593.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-aws-ecr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.17.0-202608122146.p2.g144bace.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-azure-acr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.17.0-202608122146.p2.g5bcfbfd.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-gcp-gcr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.17.0-202608122146.p2.g8ce997d.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.31.13-11.rhaos4.18.git817a650.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-202608132034.p2.g91c2408.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-clients",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-202608132034.p2.g6febe61.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-aws-ecr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-202608121933.p2.gc395190.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-azure-acr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-202608121933.p2.g9795abd.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-gcp-gcr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-202608121933.p2.g6ea2356.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "microshift",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.54-202608211117.p0.g8eb6c29.assembly.4.18.54.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.32.13-9.rhaos4.19.git2100f27.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.19.0-202608111604.p2.g63adf01.assembly.stream.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-clients",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.19.0-202608111604.p2.gb2a93a6.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-aws-ecr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.19.0-202608111604.p2.g425c1c5.assembly.stream.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "microshift",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.19.46-202609041024.p0.g59e34c7.assembly.4.19.46.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cert_manager:1.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cert-manager/jetstack-cert-manager-rhel9",
            "product": "Cert Manager support for Red Hat OpenShift release 1.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786613805",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:logging:6.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-logging/logging-loki-rhel9",
            "product": "Logging for Red Hat OpenShift 6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785419067",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:logging:6.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-logging/logging-loki-rhel9",
            "product": "Logging for Red Hat OpenShift 6.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784748010",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:logging:6.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-logging/logging-loki-rhel9",
            "product": "Logging Subsystem for Red Hat OpenShift 6.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782405469",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:logging:6.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-logging/logging-loki-rhel9",
            "product": "Logging Subsystem for Red Hat OpenShift 6.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786645248",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/backplane-rhel9-operator",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911952",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/hypershift-addon-rhel9-operator",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786912006",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "oadp/oadp-velero-plugin-rhel9",
            "product": "OpenShift API for Data Protection 1.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785177357",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "oadp/oadp-velero-plugin-rhel9",
            "product": "OpenShift API for Data Protection 1.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786946116",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "oadp/oadp-velero-rhel9",
            "product": "OpenShift API for Data Protection 1.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1788860461",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "oadp/oadp-velero-rhel9",
            "product": "OpenShift API for Data Protection 1.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784058822",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.9::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "advanced-cluster-security/rhacs-main-rhel8",
            "product": "Red Hat Advanced Cluster Security 4.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783357116",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.10::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "advanced-cluster-security/rhacs-main-rhel8",
            "product": "Red Hat Advanced Cluster Security for Kubernetes 4.10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783357140",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-rhel9-operator",
            "product": "Red Hat Developer Hub 1.10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783447707",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-rhel9-operator",
            "product": "Red Hat Developer Hub 1.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782767215",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "golang1-25-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.25.10-2.2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "golang1-26-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.26.3-2.2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhmt:1.8::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhmtc/openshift-migration-controller-rhel8",
            "product": "Red Hat Migration Toolkit 1.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783953372",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:migration_toolkit_applications:8.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "mta/mta-cli-rhel9",
            "product": "Red Hat Migration Toolkit for Applications 8.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785171639",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:migration_toolkit_applications:8.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "mta/mta-cli-rhel9",
            "product": "Red Hat Migration Toolkit for Applications 8.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784211378",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-kueue-controller-rhel9",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783544461",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-kube-auth-proxy-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787102977",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786611759",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-workload-variant-autoscaler-controller-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787562200",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.12::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-installer",
            "product": "Red Hat OpenShift Container Platform 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786752886",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-sdn-rhel8",
            "product": "Red Hat OpenShift Container Platform 4.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787002807",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-sdn-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787055135",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-sdn-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786788280",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-cli-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787549445",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-cli-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786754308",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-cli-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786489910",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-cli-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786494900",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-cli-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786496647",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-hypershift-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786573075",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.30::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/configbump-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.30",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787756267",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.30::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/traefik-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.30",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787756799",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782222217",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782223341",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782296193",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782222607",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782222163",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782223138",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782222394",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782222451",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782226178",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782224487",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782303211",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782224541",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782223045",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782222366",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782310747",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782222038",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0.12::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/node-healthcheck-rhel9-operator",
            "product": "Red Hat OpenShift Workload Availability 0.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785202723",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_snr:0.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/self-node-remediation-rhel9-operator",
            "product": "Red Hat OpenShift Workload Availability 0.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785203036",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_sbr:0.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/storage-based-remediation-rhel9-operator",
            "product": "Red Hat OpenShift Workload Availability 0.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785203474",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_mdr:0.7::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/machine-deletion-remediation-rhel9-operator",
            "product": "Red Hat OpenShift Workload Availability 0.7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785203508",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_far:0.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/fence-agents-remediation-rhel9-operator",
            "product": "Red Hat OpenShift Workload Availability 0.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785203079",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nmo:5.7::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/node-maintenance-rhel9-operator",
            "product": "Red Hat OpenShift Workload Availability 5.7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785202847",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.10::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3.10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783750447",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783751865",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784353904",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784351966",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel9",
            "product": "Red Hat Quay 3.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783955846",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.9::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784125838",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "conforma-cli-stack-v1",
            "product": "Red Hat Trusted Artifact Signer 1.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4-1.4.2",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4-1.4.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:assisted_installer:2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhai/assisted-installer-rhel9",
            "product": "Assisted Installer for Red Hat OpenShift Container Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:confidential_compute_attestation:1"
            ],
            "defaultStatus": "affected",
            "packageName": "build-of-trustee/trustee-rhel9-operator",
            "product": "Confidential Compute Attestation",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:confidential_compute_attestation:1"
            ],
            "defaultStatus": "affected",
            "packageName": "confidential-compute-attestation-tech-preview/trustee-rhel9-operator",
            "product": "Confidential Compute Attestation",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:confidential_compute_attestation:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-sandboxed-containers/osc-monitor-rhel9",
            "product": "Confidential Compute Attestation",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "cryostat/cryostat-storage-rhel9",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9",
            "product": "Custom Metric Autoscaler operator for Red Hat Openshift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ext_dns_optr:1"
            ],
            "defaultStatus": "affected",
            "packageName": "edo/external-dns-rhel9",
            "product": "ExternalDNS Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ext_dns_optr:1"
            ],
            "defaultStatus": "affected",
            "packageName": "edo/external-dns-rhel9-operator",
            "product": "ExternalDNS Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:external_secrets_operator:1"
            ],
            "defaultStatus": "affected",
            "packageName": "external-secrets-operator/external-secrets-rhel9",
            "product": "External Secrets Operator for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_file_integrity_operator:1"
            ],
            "defaultStatus": "affected",
            "packageName": "compliance/openshift-compliance-operator-bundle",
            "product": "File Integrity Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:gatekeeper:3"
            ],
            "defaultStatus": "affected",
            "packageName": "gatekeeper/gatekeeper-rhel9-operator",
            "product": "Gatekeeper 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lvms:4"
            ],
            "defaultStatus": "affected",
            "packageName": "lvms4/lvms-rhel9-operator",
            "product": "Logical Volume Manager Storage",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lvms:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "lvms4/topolvm-rhel8",
            "product": "Logical Volume Manager Storage",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lvms:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "lvms4/topolvm-rhel9",
            "product": "Logical Volume Manager Storage",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multiarch_tuning_operator"
            ],
            "defaultStatus": "unaffected",
            "packageName": "multiarch-tuning/multiarch-tuning-rhel9-operator",
            "product": "Multiarch Tuning Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/addon-manager-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/assisted-installer-rhel8",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "unknown",
            "packageName": "multicluster-engine/assisted-installer-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/clusterlifecycle-state-metrics-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "unaffected",
            "packageName": "multicluster-engine/discovery-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/maestro-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/managedcluster-import-controller-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/multicloud-manager-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/placement-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/registration-operator-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/work-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "unknown",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel8",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "unaffected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:network_observ_optr:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "network-observability/network-observability-rhel9-operator",
            "product": "Network Observability Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools"
            ],
            "defaultStatus": "affected",
            "packageName": "helm",
            "product": "OpenShift Developer Tools and Services",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_lightspeed"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-lightspeed/lightspeed-rhel9-operator",
            "product": "OpenShift Lightspeed",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines-client",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "kn-workflow-plugin",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-golang-builder-container",
            "product": "OpenShift Service Mesh 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:2"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/pilot-rhel8",
            "product": "OpenShift Service Mesh 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-golang-builder-container",
            "product": "OpenShift Service Mesh 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_power_monitoring"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-power-monitoring/power-monitoring-rhel9-operator",
            "product": "Power monitoring for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/acm-governance-policy-addon-controller-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/acm-governance-policy-framework-addon-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/config-policy-controller-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/governance-policy-propagator-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/klusterlet-addon-controller-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/thanos-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ansible-automation-platform/platform-operator-bundle",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "automation-gateway-proxy-openssl30",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "automation-gateway-proxy-openssl32",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:5"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhceph/rhceph-5-dashboard-rhel8",
            "product": "Red Hat Ceph Storage 5",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhceph/rhceph-6-dashboard-rhel9",
            "product": "Red Hat Ceph Storage 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:9"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhceph/alloy-rhel10",
            "product": "Red Hat Ceph Storage 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:certifications:9"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-certification-preflight",
            "product": "Red Hat Certification Program for Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "flightctl",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhem/flightctl-api-rhel9",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "gvisor-tap-vsock",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "ignition",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "podman",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "rhel10/bootc-image-builder",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "rhel10-eus/rhel-10.0-bootc-image-builder",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "buildah",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "conmon",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "gvisor-tap-vsock",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "ignition",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "podman",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhel9/bootc-image-builder",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhel9-eus/rhel-9.6-bootc-image-builder",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "skopeo",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lightspeed_for_runtimes:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator",
            "product": "Red Hat Lightspeed for Runtimes Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ai-gateway-payload-processing-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-data-science-pipelines-argo-argoexec-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-kserve-llmisvc-controller-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-kueue-controller-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-llm-d-inference-scheduler-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-llm-d-routing-sidecar-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-maas-api-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-mlflow-operator-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ml-pipelines-api-server-v2-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ml-pipelines-driver-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ml-pipelines-launcher-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-model-controller-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-modelmesh-serving-controller-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-model-registry-operator-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-model-registry-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-model-serving-api-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_cluster_manager_cli:1"
            ],
            "defaultStatus": "affected",
            "packageName": "ocm-cli-clients/ocm-cli-rhel9",
            "product": "Red Hat OpenShift Cluster Manager CLI",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "conmon",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ignition",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "kata-containers",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-node",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-sdn-rhel7",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-golang-builder-container",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "podman",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "skopeo",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ocs4/cephcsi-rhel8",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "odf4/cephcsi-rhel8",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cli-rhel9",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "odf4/odf-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:devworkspace"
            ],
            "defaultStatus": "affected",
            "packageName": "devworkspace/devworkspace-rhel9-operator",
            "product": "Red Hat OpenShift Dev Workspaces Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_distributed_tracing:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosdt/tempo-rhel9",
            "product": "Red Hat OpenShift distributed tracing 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:windows_machine_config"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator",
            "product": "Red Hat OpenShift for Windows Containers",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_gitops:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-gitops-1/argocd-rhel8",
            "product": "Red Hat OpenShift GitOps",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_gitops:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-gitops-1/argocd-rhel9",
            "product": "Red Hat OpenShift GitOps",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-native-virtualization/kubevirt-apiserver-proxy-rhel9",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-native-virtualization/virt-api-rhel9",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "affected",
            "packageName": "kubevirt",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-golang-builder-container",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosp-rhel8/osp-director-operator-bundle",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosp-rhel9/osp-director-operator-bundle",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoso-operators/ovn-rhel9-operator",
            "product": "Red Hat OpenStack Platform 18.0",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quay:3"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-builder-rhel8",
            "product": "Red Hat Quay 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "affected",
            "packageName": "satellite/iop-vmaas-rhel9",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_interconnect:1"
            ],
            "defaultStatus": "affected",
            "packageName": "skupper-cli",
            "product": "Red Hat Service Interconnect 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_interconnect:2"
            ],
            "defaultStatus": "affected",
            "packageName": "skupper-cli",
            "product": "Red Hat Service Interconnect 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_security_profiles_operator:1"
            ],
            "defaultStatus": "affected",
            "packageName": "compliance/openshift-security-profiles-rhel8-operator",
            "product": "Security Profiles Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9",
            "product": "Zero Trust Workload Identity Manager",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
            ],
            "defaultStatus": "affected",
            "packageName": "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9",
            "product": "Zero Trust Workload Identity Manager - Tech Preview",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-07T19:41:18.615Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1046",
                "description": "Creation of Immutable Text Using String Concatenation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T12:04:32.139Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42499"
          },
          {
            "name": "RHBZ#2467809",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50319"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59830"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56785"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56910"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56852"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60018"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57482"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54552"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50336"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57845"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57914"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:63636"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49702"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65335"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66327"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:63332"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22120"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:63022"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65534"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65116"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65895"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:64818"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:63163"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22112"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62407"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67148"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61253"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62754"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57649"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62753"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49712"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51112"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65336"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62803"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22121"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62406"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65886"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65117"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65153"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54531"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34364"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56340"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47952"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50843"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51033"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59467"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66022"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:43692"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36319"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36625"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36754"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33574"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17713"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17714"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41928"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50300"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:43038"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60520"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59833"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56789"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56912"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56854"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60023"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57487"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54555"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54583"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54602"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62260"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33120"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33123"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33142"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33150"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54287"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54284"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54286"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54285"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54274"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54283"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41031"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42146"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:43052"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42796"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41066"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40262"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36797"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57194"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:50319: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59830: Red Hat OpenShift Container Platform 4.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56785: Red Hat OpenShift Container Platform 4.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56910: Red Hat OpenShift Container Platform 4.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56852: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60018: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57482: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54552: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:50336: Red Hat Ansible Automation Platform 2.6 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57845: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57914: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:63636: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49702: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65335: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66327: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:63332: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22120: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:63022: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65534: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65116: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65895: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:64818: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:63163: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22112: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62407: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:67148: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:61253: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62754: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57649: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62753: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49712: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51112: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65336: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62803: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22121: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62406: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65886: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65117: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65153: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54531: Cert Manager support for Red Hat OpenShift release 1.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34364: Logging Subsystem for Red Hat OpenShift 6.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56340: Logging Subsystem for Red Hat OpenShift 6.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47952: Logging for Red Hat OpenShift 6.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:50843: Logging for Red Hat OpenShift 6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51033: OpenShift API for Data Protection 1.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59467: OpenShift API for Data Protection 1.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66022: OpenShift API for Data Protection 1.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:43692: OpenShift API for Data Protection 1.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36319: Red Hat Advanced Cluster Security 4.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36625: Red Hat Advanced Cluster Security for Kubernetes 4.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36754: Red Hat Developer Hub 1.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33574: Red Hat Developer Hub 1.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17713: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17714: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41928: Red Hat Migration Toolkit 1.8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:50300: Red Hat Migration Toolkit for Applications 8.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:43038: Red Hat Migration Toolkit for Applications 8.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60520: Red Hat OpenShift AI 3.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59833: Red Hat OpenShift Container Platform 4.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56789: Red Hat OpenShift Container Platform 4.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56912: Red Hat OpenShift Container Platform 4.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56854: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60023: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57487: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54555: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54583: Red Hat OpenShift Container Platform 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54602: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62260: Red Hat OpenShift Dev Spaces 3.30"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33120: Red Hat OpenShift Service Mesh 3.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33123: Red Hat OpenShift Service Mesh 3.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33142: Red Hat OpenShift Service Mesh 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33150: Red Hat OpenShift Service Mesh 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54287: Red Hat OpenShift Workload Availability 0.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54284: Red Hat OpenShift Workload Availability 0.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54286: Red Hat OpenShift Workload Availability 0.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54285: Red Hat OpenShift Workload Availability 0.7"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54274: Red Hat OpenShift Workload Availability 0.8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54283: Red Hat OpenShift Workload Availability 5.7"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41031: Red Hat Quay 3.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42146: Red Hat Quay 3.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:43052: Red Hat Quay 3.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42796: Red Hat Quay 3.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41066: Red Hat Quay 3.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40262: Red Hat Quay 3.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36797: Red Hat Trusted Artifact Signer 1.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57194: multicluster engine for Kubernetes 2.11"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-07T20:00:51.685Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-07T19:41:18.615Z",
            "value": "Made public."
          }
        ],
        "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/mail",
          "product": "net/mail",
          "programRoutines": [
            {
              "name": "addrParser.consumePhrase"
            },
            {
              "name": "AddressParser.Parse"
            },
            {
              "name": "AddressParser.ParseList"
            },
            {
              "name": "Header.AddressList"
            },
            {
              "name": "ParseAddress"
            },
            {
              "name": "ParseAddressList"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.3",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-07T19:41:18.615Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/78987"
        },
        {
          "url": "https://go.dev/cl/771520"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4977"
        }
      ],
      "title": "Quadratic string concatenation in consumePhrase in net/mail"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-42499",
    "datePublished": "2026-05-07T19:41:18.615Z",
    "dateReserved": "2026-04-28T00:21:12.791Z",
    "dateUpdated": "2026-09-14T12:04:32.139Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42504 (GCVE-0-2026-42504)

Vulnerability from cvelistv5 – Published: 2026-06-02 22:01 – Updated: 2026-09-10 16:34

Title

Quadratic complexity in WordDecoder.DecodeHeader in mime

Summary

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-03 14:05 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/79217
https://go.dev/cl/774481
https://groups.google.com/g/golang-announce/c/tKs…
https://pkg.go.dev/vuln/GO-2026-5038

Impacted products

1 product

Vendor	Product	Version
Go standard library	mime	Affected: 0 , < 1.25.11 (semver) Affected: 1.26.0-0 , < 1.26.4 (semver)

Credits

p4p3r (https://hackerone.com/p4p3r_hak)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42504",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T14:05:39.682615Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-407",
                "description": "CWE-407 Inefficient Algorithmic Complexity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T14:06:13.623Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "mime",
          "product": "mime",
          "programRoutines": [
            {
              "name": "WordDecoder.DecodeHeader"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.4",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "p4p3r (https://hackerone.com/p4p3r_hak)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T16:34:26.261Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/79217"
        },
        {
          "url": "https://go.dev/cl/774481"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5038"
        }
      ],
      "title": "Quadratic complexity in WordDecoder.DecodeHeader in mime"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-42504",
    "datePublished": "2026-06-02T22:01:37.219Z",
    "dateReserved": "2026-04-28T00:21:12.792Z",
    "dateUpdated": "2026-09-10T16:34:26.261Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55677 (GCVE-0-2026-55677)

Vulnerability from cvelistv5 – Published: 2026-06-26 16:15 – Updated: 2026-06-26 16:50

Title

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

Summary

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-26 16:50 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/labstack/echo/security/advisor…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
labstack	echo	Affected: < 4.15.3 Affected: >= 5.0.0, < 5.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55677",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-26T16:50:52.168170Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T16:50:57.019Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "echo",
          "vendor": "labstack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.15.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo\u0027s router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-26T16:15:55.633Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq"
        }
      ],
      "source": {
        "advisory": "GHSA-vfp3-v2gw-7wfq",
        "discovery": "UNKNOWN"
      },
      "title": "Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55677",
    "datePublished": "2026-06-26T16:15:55.633Z",
    "dateReserved": "2026-06-17T00:05:03.778Z",
    "dateUpdated": "2026-06-26T16:50:57.019Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:67148

CVE-2025-22866 (GCVE-0-2025-22866)

CVE-2026-32281 (GCVE-0-2026-32281)

CVE-2026-41178 (GCVE-0-2026-41178)

CVE-2026-42499 (GCVE-0-2026-42499)

CVE-2026-42504 (GCVE-0-2026-42504)

CVE-2026-55677 (GCVE-0-2026-55677)

Tags

Sightings

Nomenclature