RHSA-2026:68681

Vulnerability from csaf_redhat - Published: 2026-09-17 14:19 - Updated: 2026-09-21 22:28
Summary
Red Hat Security Advisory: Red Hat Migration Toolkit for Containers
Severity
Important
Notes
Topic: A new version of Migration Toolkit for Containers (MTC) is now available.
Details: The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-14257

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64 —
Workaround
Threats
Impact Important
CVE-2026-16221

A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators (URLs), unlike Node.js's native WHATWG URL parser. This discrepancy can cause applications that use fast-uri for security policy enforcement, such as allowlists or Server-Side Request Forgery (SSRF) filtering, to misidentify the intended host. Consequently, an attacker could bypass these security policies, potentially redirecting traffic to unintended internal or sensitive network destinations.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-807 - Reliance on Untrusted Inputs in a Security Decision
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-27145

A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-606 - Unchecked Input for Loop Condition
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64 —
Workaround
Threats
Impact Important
CVE-2026-33186

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Affected products
Fixed 1 product, the same list as for CVE-2026-27145
Known not affected 10 products, the same list as for CVE-2026-27145
Threats
Impact Important
CVE-2026-33818

A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Affected products
Fixed 1 product, the same list as for CVE-2026-27145
Known not affected 10 products, the same list as for CVE-2026-27145
Threats
Impact Important
CVE-2026-42504

A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Fixed 1 product, the same list as for CVE-2026-27145
Known not affected 10 products, the same list as for CVE-2026-27145
Threats
Impact Important
CVE-2026-56852

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products
Fixed 1 product, the same list as for CVE-2026-27145
Known not affected 10 products, the same list as for CVE-2026-27145
Threats
Impact Important
CVE-2026-56853

A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-27145
Known not affected 10 products, the same list as for CVE-2026-27145
Threats
Impact Important
CVE-2026-56859

A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Affected products
Fixed 1 product, the same list as for CVE-2026-27145
Known not affected 10 products, the same list as for CVE-2026-27145
Threats
Impact Important
CVE-2026-56860

A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-27145
Known not affected 10 products, the same list as for CVE-2026-27145
Threats
Impact Important
CVE-2026-56862

A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Fixed 1 product, the same list as for CVE-2026-27145
Known not affected 10 products, the same list as for CVE-2026-27145
Threats
Impact Important
CVE-2026-59869

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-606 - Unchecked Input for Loop Condition
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-59873

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-59874

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop, repeatedly parsing the same header and preventing further processing. This can lead to a denial of service (DoS) condition, making the affected system or application unresponsive.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-606 - Unchecked Input for Loop Condition
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-67313

A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-67314

A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-67320

A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-67321

A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This can lead to a denial of service, making the affected request path unavailable to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-69152

A flaw was found in the brace-expansion library. The `expand()` function does not apply `maxLength` when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-69192

A flaw was found in the `ip-address` library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.

8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CWE-1389 - Incorrect Parsing of Numbers with Different Radices
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-73088

A flaw was found in Browserslist, a tool for sharing browser and Node.js versions. An attacker could provide specially crafted statistics data, which the tool processes without proper validation. This improper handling of untrusted data can lead to prototype pollution, potentially causing the application to crash and resulting in a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-73089

A flaw was found in Browserslist, a configuration tool for front-end development. An attacker can exploit this vulnerability by influencing repeated query values, leading to unbounded memory growth. This issue can cause the application to consume excessive memory, resulting in an out-of-memory process crash and a Denial of Service (DoS) for affected systems.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-73566

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could provide a specially crafted tar archive with a long-path header. When processing this archive with a non-empty member-selection list, an uncontrolled recursion in the `filesFilter` function can lead to a stack overflow. This issue results in a denial of service (DoS) by terminating Node.js applications that consume these archives.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-73643

A flaw was found in js-yaml, a JavaScript YAML parser. A remote attacker could exploit this vulnerability by providing specially crafted YAML input containing nested flow collections. This can lead to exponential parsing time when the application processes untrusted input, consuming excessive CPU resources. This resource exhaustion can block the Node.js event loop and cause a Denial of Service (DoS) for the affected process.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1333 - Inefficient Regular Expression Complexity
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-73646

A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted `sourceMappingURL` values in untrusted CSS files. This allows the attacker to disclose sensitive `sourcesContent` from arbitrary `.map` files accessible on the system, leading to information disclosure.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-75899

A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a loopback address. This vulnerability can lead to Server-Side Request Forgery (SSRF) and bypass host-based security policies.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-140 - Improper Neutralization of Delimiters
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-75931

A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names (IDN) to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an application might validate a URI against a security policy using one hostname, but then resolve to a different, potentially malicious, hostname. This discrepancy could allow an attacker to bypass security policies and access unauthorized resources.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-75975

A flaw was found in fast-uri, a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not fully validate the IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. This can lead to a malformed, attacker-controlled host being normalized into a different, valid IPv6 destination, such as a local or private IPv6 target. An application normalizing untrusted URLs before outbound requests, redirects, or proxy routing could be redirected, resulting in a server-side request forgery (SSRF) and address-policy bypass.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-918 - Server-Side Request Forgery (SSRF)
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-76172

A flaw was found in fast-uri, a software component used for parsing Uniform Resource Identifiers (URIs) in Node.js applications. This vulnerability arises from an issue in how fast-uri processes the scheme part of a URI, specifically when it contains special characters that are percent-encoded. An attacker can exploit this by crafting a malicious URI, causing the parser to misinterpret the host, which can lead to serious security risks. These risks include unauthorized redirection to external websites, server-side request forgery (SSRF) where the application makes unintended requests to internal or external resources, and bypassing security policies.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-76 - Improper Neutralization of Equivalent Special Elements
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-76844

A flaw was found in webpack-dev-middleware. A remote attacker can exploit a path traversal vulnerability when the configured publicPath lacks a trailing slash. By sending a specially crafted request, the attacker can bypass a security guard, allowing the middleware to resolve files from one directory above the intended output path. This could lead to information disclosure if the middleware is configured to use the physical filesystem.

8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-82417

A flaw was found in qs. The `qs.stringify` function, responsible for serializing objects, does not properly validate the `isBuffer` property of an object's constructor before attempting to invoke it. An unauthenticated attacker can provide specially crafted input that, when processed and then serialized by `qs.stringify`, triggers a `TypeError`. This vulnerability can lead to a Denial of Service (DoS), causing affected applications to return a 500 error or, in certain scenarios, terminate the application process.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1287 - Improper Validation of Specified Type of Input
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-84292

A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier (URI) without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker's host as legitimate.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-140 - Improper Neutralization of Delimiters
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
CVE-2026-84375

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a denial of service (DoS) for applications that process untrusted YAML input.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Moderate
CVE-2026-84394

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier (URI) hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policies, such as Server-Side Request Forgery (SSRF) denylists or redirect allowlists, by causing an application to evaluate its policy against an incorrect host string. This could result in unintended network requests or access to unauthorized resources.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-1289 - Improper Validation of Unsafe Equivalence in Input
Affected products
Fixed 1 product, the same list as for CVE-2026-14257
Known not affected 10 products, the same list as for CVE-2026-14257
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:68681 self
https://access.redhat.com/security/cve/CVE-2026-14257 external
https://access.redhat.com/security/cve/CVE-2026-16221 external
https://access.redhat.com/security/cve/CVE-2026-27145 external
https://access.redhat.com/security/cve/CVE-2026-33186 external
https://access.redhat.com/security/cve/CVE-2026-33818 external
https://access.redhat.com/security/cve/CVE-2026-42504 external
https://access.redhat.com/security/cve/CVE-2026-56852 external
https://access.redhat.com/security/cve/CVE-2026-56853 external
https://access.redhat.com/security/cve/CVE-2026-56859 external
https://access.redhat.com/security/cve/CVE-2026-56860 external
https://access.redhat.com/security/cve/CVE-2026-56862 external
https://access.redhat.com/security/cve/CVE-2026-59869 external
https://access.redhat.com/security/cve/CVE-2026-59873 external
https://access.redhat.com/security/cve/CVE-2026-59874 external
https://access.redhat.com/security/cve/CVE-2026-67313 external
https://access.redhat.com/security/cve/CVE-2026-67314 external
https://access.redhat.com/security/cve/CVE-2026-67320 external
https://access.redhat.com/security/cve/CVE-2026-67321 external
https://access.redhat.com/security/cve/CVE-2026-69152 external
https://access.redhat.com/security/cve/CVE-2026-69192 external
https://access.redhat.com/security/cve/CVE-2026-73088 external
https://access.redhat.com/security/cve/CVE-2026-73089 external
https://access.redhat.com/security/cve/CVE-2026-73566 external
https://access.redhat.com/security/cve/CVE-2026-73643 external
https://access.redhat.com/security/cve/CVE-2026-73646 external
https://access.redhat.com/security/cve/CVE-2026-75899 external
https://access.redhat.com/security/cve/CVE-2026-75931 external
https://access.redhat.com/security/cve/CVE-2026-75975 external
https://access.redhat.com/security/cve/CVE-2026-76172 external
https://access.redhat.com/security/cve/CVE-2026-76844 external
https://access.redhat.com/security/cve/CVE-2026-82417 external
https://access.redhat.com/security/cve/CVE-2026-84292 external
https://access.redhat.com/security/cve/CVE-2026-84375 external
https://access.redhat.com/security/cve/CVE-2026-84394 external
https://access.redhat.com/security/updates/classi… external
https://docs.redhat.com/en/documentation/openshif… external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-14257 self
https://bugzilla.redhat.com/show_bug.cgi?id=2506433 external
https://www.cve.org/CVERecord?id=CVE-2026-14257 external
https://nvd.nist.gov/vuln/detail/CVE-2026-14257 external
https://github.com/juliangruber/brace-expansion external
https://github.com/juliangruber/brace-expansion/c… external
https://www.npmjs.com/package/brace-expansion external
https://access.redhat.com/security/cve/CVE-2026-16221 self
https://bugzilla.redhat.com/show_bug.cgi?id=2502307 external
https://www.cve.org/CVERecord?id=CVE-2026-16221 external
https://nvd.nist.gov/vuln/detail/CVE-2026-16221 external
https://cna.openjsf.org/security-advisories.html external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-27145 self
https://bugzilla.redhat.com/show_bug.cgi?id=2484207 external
https://www.cve.org/CVERecord?id=CVE-2026-27145 external
https://nvd.nist.gov/vuln/detail/CVE-2026-27145 external
https://go.dev/cl/783621 external
https://go.dev/issue/79694 external
https://groups.google.com/g/golang-announce/c/tKs… external
https://pkg.go.dev/vuln/GO-2026-5037 external
https://access.redhat.com/security/cve/CVE-2026-33186 self
https://bugzilla.redhat.com/show_bug.cgi?id=2449833 external
https://www.cve.org/CVERecord?id=CVE-2026-33186 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 external
https://github.com/grpc/grpc-go/security/advisori… external
https://access.redhat.com/security/cve/CVE-2026-33818 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515815 external
https://www.cve.org/CVERecord?id=CVE-2026-33818 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33818 external
https://go.dev/cl/814980 external
https://go.dev/issue/80405 external
https://groups.google.com/g/golang-announce/c/94p… external
https://pkg.go.dev/vuln/GO-2026-5972 external
https://access.redhat.com/security/cve/CVE-2026-42504 self
https://bugzilla.redhat.com/show_bug.cgi?id=2484204 external
https://www.cve.org/CVERecord?id=CVE-2026-42504 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42504 external
https://go.dev/cl/774481 external
https://go.dev/issue/79217 external
https://pkg.go.dev/vuln/GO-2026-5038 external
https://access.redhat.com/security/cve/CVE-2026-56852 self
https://bugzilla.redhat.com/show_bug.cgi?id=2504233 external
https://www.cve.org/CVERecord?id=CVE-2026-56852 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56852 external
https://go.dev/cl/794100 external
https://go.dev/issue/80142 external
https://pkg.go.dev/vuln/GO-2026-5970 external
https://access.redhat.com/security/cve/CVE-2026-56853 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515827 external
https://www.cve.org/CVERecord?id=CVE-2026-56853 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56853 external
https://go.dev/cl/795540 external
https://go.dev/issue/80205 external
https://pkg.go.dev/vuln/GO-2026-6089 external
https://access.redhat.com/security/cve/CVE-2026-56859 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515840 external
https://www.cve.org/CVERecord?id=CVE-2026-56859 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56859 external
https://go.dev/cl/803320 external
https://go.dev/issue/80481 external
https://pkg.go.dev/vuln/GO-2026-6088 external
https://access.redhat.com/security/cve/CVE-2026-56860 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515820 external
https://www.cve.org/CVERecord?id=CVE-2026-56860 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56860 external
https://go.dev/cl/803681 external
https://go.dev/issue/80494 external
https://pkg.go.dev/vuln/GO-2026-6218 external
https://access.redhat.com/security/cve/CVE-2026-56862 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515839 external
https://www.cve.org/CVERecord?id=CVE-2026-56862 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56862 external
https://go.dev/cl/804261 external
https://go.dev/issue/80528 external
https://pkg.go.dev/vuln/GO-2026-6090 external
https://access.redhat.com/security/cve/CVE-2026-59869 self
https://bugzilla.redhat.com/show_bug.cgi?id=2498122 external
https://www.cve.org/CVERecord?id=CVE-2026-59869 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59869 external
https://github.com/nodeca/js-yaml/commit/24f13e79… external
https://github.com/nodeca/js-yaml/commit/59423c6f… external
https://github.com/nodeca/js-yaml/releases/tag/3.15.0 external
https://github.com/nodeca/js-yaml/releases/tag/4.3.0 external
https://github.com/nodeca/js-yaml/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-59873 self
https://bugzilla.redhat.com/show_bug.cgi?id=2498120 external
https://www.cve.org/CVERecord?id=CVE-2026-59873 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59873 external
https://github.com/isaacs/node-tar/commit/2812e93… external
https://github.com/isaacs/node-tar/releases/tag/v7.5.19 external
https://github.com/isaacs/node-tar/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-59874 self
https://bugzilla.redhat.com/show_bug.cgi?id=2498116 external
https://www.cve.org/CVERecord?id=CVE-2026-59874 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59874 external
https://github.com/isaacs/node-tar/commit/9e78bf0… external
https://github.com/isaacs/node-tar/releases/tag/v7.5.18 external
https://github.com/isaacs/node-tar/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-67313 self
https://www.cve.org/CVERecord?id=CVE-2026-67313 external
https://access.redhat.com/security/cve/CVE-2026-67314 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510030 external
https://www.cve.org/CVERecord?id=CVE-2026-67314 external
https://nvd.nist.gov/vuln/detail/CVE-2026-67314 external
https://github.com/axios/axios/security/advisorie… external
https://www.vulncheck.com/advisories/axios-before… external
https://access.redhat.com/security/cve/CVE-2026-67320 self
https://bugzilla.redhat.com/show_bug.cgi?id=2509993 external
https://www.cve.org/CVERecord?id=CVE-2026-67320 external
https://nvd.nist.gov/vuln/detail/CVE-2026-67320 external
https://github.com/axios/axios/commit/df53d7dd99b… external
https://github.com/axios/axios/security/advisorie… external
https://www.vulncheck.com/advisories/axios-before… external
https://access.redhat.com/security/cve/CVE-2026-67321 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510011 external
https://www.cve.org/CVERecord?id=CVE-2026-67321 external
https://nvd.nist.gov/vuln/detail/CVE-2026-67321 external
https://github.com/axios/axios/security/advisorie… external
https://www.vulncheck.com/advisories/axios-before… external
https://access.redhat.com/security/cve/CVE-2026-69152 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510722 external
https://www.cve.org/CVERecord?id=CVE-2026-69152 external
https://nvd.nist.gov/vuln/detail/CVE-2026-69152 external
https://github.com/juliangruber/brace-expansion/c… external
https://github.com/juliangruber/brace-expansion/c… external
https://github.com/juliangruber/brace-expansion/c… external
https://github.com/juliangruber/brace-expansion/c… external
https://github.com/juliangruber/brace-expansion/s… external
https://access.redhat.com/security/cve/CVE-2026-69192 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510801 external
https://www.cve.org/CVERecord?id=CVE-2026-69192 external
https://nvd.nist.gov/vuln/detail/CVE-2026-69192 external
https://github.com/beaugunderson/ip-address/commi… external
https://github.com/beaugunderson/ip-address/relea… external
https://github.com/beaugunderson/ip-address/secur… external
https://access.redhat.com/security/cve/CVE-2026-73088 self
https://bugzilla.redhat.com/show_bug.cgi?id=2514177 external
https://www.cve.org/CVERecord?id=CVE-2026-73088 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73088 external
https://github.com/browserslist/browserslist/comm… external
https://github.com/browserslist/browserslist/rele… external
https://github.com/browserslist/browserslist/secu… external
https://access.redhat.com/security/cve/CVE-2026-73089 self
https://bugzilla.redhat.com/show_bug.cgi?id=2514195 external
https://www.cve.org/CVERecord?id=CVE-2026-73089 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73089 external
https://github.com/browserslist/browserslist/comm… external
https://github.com/browserslist/browserslist/secu… external
https://access.redhat.com/security/cve/CVE-2026-73566 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515509 external
https://www.cve.org/CVERecord?id=CVE-2026-73566 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73566 external
https://github.com/isaacs/node-tar/commit/631ae59… external
https://github.com/isaacs/node-tar/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-73643 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515531 external
https://www.cve.org/CVERecord?id=CVE-2026-73643 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73643 external
https://github.com/nodeca/js-yaml/commit/3e5240f9… external
https://github.com/nodeca/js-yaml/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-73646 self
https://bugzilla.redhat.com/show_bug.cgi?id=2517456 external
https://www.cve.org/CVERecord?id=CVE-2026-73646 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73646 external
https://github.com/postcss/postcss/commit/95663d3… external
https://github.com/postcss/postcss/releases/tag/8.5.18 external
https://github.com/postcss/postcss/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-75899 self
https://bugzilla.redhat.com/show_bug.cgi?id=2521778 external
https://www.cve.org/CVERecord?id=CVE-2026-75899 external
https://nvd.nist.gov/vuln/detail/CVE-2026-75899 external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-75931 self
https://bugzilla.redhat.com/show_bug.cgi?id=2521777 external
https://www.cve.org/CVERecord?id=CVE-2026-75931 external
https://nvd.nist.gov/vuln/detail/CVE-2026-75931 external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-75975 self
https://bugzilla.redhat.com/show_bug.cgi?id=2521779 external
https://www.cve.org/CVERecord?id=CVE-2026-75975 external
https://nvd.nist.gov/vuln/detail/CVE-2026-75975 external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-76172 self
https://bugzilla.redhat.com/show_bug.cgi?id=2521798 external
https://www.cve.org/CVERecord?id=CVE-2026-76172 external
https://nvd.nist.gov/vuln/detail/CVE-2026-76172 external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-76844 self
https://bugzilla.redhat.com/show_bug.cgi?id=2521896 external
https://www.cve.org/CVERecord?id=CVE-2026-76844 external
https://nvd.nist.gov/vuln/detail/CVE-2026-76844 external
https://github.com/advisories/GHSA-wr3j-pwj9-hqq6 external
https://github.com/webpack/webpack-dev-middleware external
https://github.com/webpack/webpack-dev-middleware… external
https://www.vulncheck.com/advisories/webpack-dev-… external
https://access.redhat.com/security/cve/CVE-2026-82417 self
https://bugzilla.redhat.com/show_bug.cgi?id=2525936 external
https://www.cve.org/CVERecord?id=CVE-2026-82417 external
https://nvd.nist.gov/vuln/detail/CVE-2026-82417 external
https://github.com/ljharb/qs/commit/e83d321ffafb3… external
https://github.com/ljharb/qs/security/advisories/… external
https://access.redhat.com/security/cve/CVE-2026-84292 self
https://bugzilla.redhat.com/show_bug.cgi?id=2527747 external
https://www.cve.org/CVERecord?id=CVE-2026-84292 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84292 external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-84375 self
https://bugzilla.redhat.com/show_bug.cgi?id=2527118 external
https://www.cve.org/CVERecord?id=CVE-2026-84375 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84375 external
https://github.com/nodeca/js-yaml/commit/3485bc06… external
https://github.com/nodeca/js-yaml/commit/6a8e05f9… external
https://github.com/nodeca/js-yaml/commit/d90b6612… external
https://github.com/nodeca/js-yaml/pull/797 external
https://github.com/nodeca/js-yaml/releases/tag/3.15.2 external
https://github.com/nodeca/js-yaml/releases/tag/4.3.2 external
https://github.com/nodeca/js-yaml/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-84394 self
https://bugzilla.redhat.com/show_bug.cgi?id=2527756 external
https://www.cve.org/CVERecord?id=CVE-2026-84394 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84394 external
https://github.com/fastify/fast-uri/security/advi… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new version of Migration Toolkit for Containers (MTC) is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Migration Toolkit for Containers (MTC) enables you to migrate\nKubernetes resources, persistent volume data, and internal container images\nbetween OpenShift Container Platform clusters, using the MTC web console or\nthe Kubernetes API.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:68681",
        "url": "https://access.redhat.com/errata/RHSA-2026:68681"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-14257",
        "url": "https://access.redhat.com/security/cve/CVE-2026-14257"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-16221",
        "url": "https://access.redhat.com/security/cve/CVE-2026-16221"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27145",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27145"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33186"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33818",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42504",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42504"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56853",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56859",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56860",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56862",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59869",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59873",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59873"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59874",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59874"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67313",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67313"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67314",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67314"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67320",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67320"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67321",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67321"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69152",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69152"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69192",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69192"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73088",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73088"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73089",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73089"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73566",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73566"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73643",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73643"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73646",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73646"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-75899",
        "url": "https://access.redhat.com/security/cve/CVE-2026-75899"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-75931",
        "url": "https://access.redhat.com/security/cve/CVE-2026-75931"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-75975",
        "url": "https://access.redhat.com/security/cve/CVE-2026-75975"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-76172",
        "url": "https://access.redhat.com/security/cve/CVE-2026-76172"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-76844",
        "url": "https://access.redhat.com/security/cve/CVE-2026-76844"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-82417",
        "url": "https://access.redhat.com/security/cve/CVE-2026-82417"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84292",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84292"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84375",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84375"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84394",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84394"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/migration_toolkit_for_containers/index",
        "url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/migration_toolkit_for_containers/index"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68681.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Migration Toolkit for Containers",
    "tracking": {
      "current_release_date": "2026-09-21T22:28:11+00:00",
      "generator": {
        "date": "2026-09-21T22:28:11+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:68681",
      "initial_release_date": "2026-09-17T14:19:21+00:00",
      "revision_history": [
        {
          "date": "2026-09-17T14:19:21+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-17T14:19:22+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-21T22:28:11+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Migration Toolkit 1.8",
                "product": {
                  "name": "Red Hat Migration Toolkit 1.8",
                  "product_id": "Red Hat Migration Toolkit 1.8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhmt:1.8::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Migration Toolkit"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-controller-rhel8@sha256%3A87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-controller-rhel8\u0026tag=1789377223"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-hook-runner-rhel8@sha256%3Ab09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8\u0026tag=1789386375"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-log-reader-rhel8@sha256%3A9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8\u0026tag=1789375331"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-must-gather-rhel8@sha256%3A8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8\u0026tag=1789375339"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-openvpn-rhel8@sha256%3Ace435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8\u0026tag=1789447887"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-rhel8-operator@sha256%3A467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-rhel8-operator\u0026tag=1789546352"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-operator-bundle@sha256%3A8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-operator-bundle\u0026tag=1789546820"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-registry-rhel8@sha256%3A42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-registry-rhel8\u0026tag=1789447846"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-rsync-transfer-rhel8@sha256%3Ab0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8\u0026tag=1789375338"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-ui-rhel8@sha256%3Acc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-ui-rhel8\u0026tag=1789546373"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-velero-plugin-for-mtc-rhel8@sha256%3A1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8\u0026tag=1789375340"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-14257",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-23T14:01:26.376839+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506433"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the brace-expansion npm package. The expand() function limits the number of generated results but does not bound the length of each result string. By chaining multiple brace groups, an attacker can keep the result count under the limit while making each result progressively longer, causing total memory consumption to grow until the Node.js process crashes with an uncatchable out-of-memory error. This affects any application that passes attacker-influenced strings to brace-expansion directly or transitively via minimatch or glob brace patterns.\n\nNote: In the majority of Red Hat products, brace-expansion is brought in as a transitive dependency of minimatch or glob and is not used at runtime. It is typically only invoked during build or development tooling and is not directly exposed to untrusted network input, reducing the practical exploitability of this flaw.\n\n```\n$ npm ls --omit=dev brace-expansion\nnpm@10.9.8 /usr/lib/node_modules/npm\n`-- minimatch@9.0.9\n  `-- brace-expansion@2.0.2\n```",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14257"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506433",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506433"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14257",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14257"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14257",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14257"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion",
          "url": "https://github.com/juliangruber/brace-expansion"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
          "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-07-23T12:54:23.124000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "Do not pass untrusted or user-controlled input to brace-expansion\u0027s expand() function or to libraries that use it for glob pattern matching (such as minimatch or glob). Validate and sanitize any brace patterns before expansion.\n\nWhere possible, upgrade to brace-expansion 1.1.17, 2.1.3, 3.0.3, or 5.0.8 which add a maxLength option that bounds accumulated output.\n\nAs an additional defense-in-depth measure, enforce memory limits on Node.js processes using operating system resource controls such as cgroups or Kubernetes resource limits (spec.containers[].resources.limits.memory) to prevent a single process from exhausting system memory and causing a wider outage.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function"
    },
    {
      "cve": "CVE-2026-16221",
      "cwe": {
        "id": "CWE-807",
        "name": "Reliance on Untrusted Inputs in a Security Decision"
      },
      "discovery_date": "2026-07-19T15:02:40.167601+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2502307"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators (URLs), unlike Node.js\u0027s native WHATWG URL parser. This discrepancy can cause applications that use fast-uri for security policy enforcement, such as allowlists or Server-Side Request Forgery (SSRF) filtering, to misidentify the intended host. Consequently, an attacker could bypass these security policies, potentially redirecting traffic to unintended internal or sensitive network destinations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in fast-uri allows for a security policy bypass due to inconsistent URL parsing between fast-uri and Node.js\u0027s native WHATWG URL parser. Applications within Red Hat Hardened Images that rely on fast-uri for host-based policy enforcement, such as allowlists or Server-Side Request Forgery (SSRF) filtering, can be misled by specially crafted URLs. This could enable an attacker to redirect traffic to unintended internal or sensitive network destinations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16221"
        },
        {
          "category": "external",
          "summary": "RHBZ#2502307",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502307"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16221",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16221"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16221",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16221"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx"
        }
      ],
      "release_date": "2026-07-19T14:08:32.993000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency"
    },
    {
      "cve": "CVE-2026-27145",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-06-02T23:01:08.992540+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484207"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484207",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27145",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/783621",
          "url": "https://go.dev/cl/783621"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79694",
          "url": "https://go.dev/issue/79694"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5037",
          "url": "https://pkg.go.dev/vuln/GO-2026-5037"
        }
      ],
      "release_date": "2026-06-02T22:01:36.954000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "cve": "CVE-2026-33186",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-03-20T23:02:27.802640+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449833"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449833",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
        }
      ],
      "release_date": "2026-03-20T22:23:32.147000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
    },
    {
      "cve": "CVE-2026-33818",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:12:37.151735+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/814980",
          "url": "https://go.dev/cl/814980"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80405",
          "url": "https://go.dev/issue/80405"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5972",
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "release_date": "2026-08-13T21:58:52.821000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "cve": "CVE-2026-42504",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-06-02T23:01:00.320527+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484204"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484204",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42504",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/774481",
          "url": "https://go.dev/cl/774481"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79217",
          "url": "https://go.dev/issue/79217"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5038",
          "url": "https://pkg.go.dev/vuln/GO-2026-5038"
        }
      ],
      "release_date": "2026-06-02T22:01:37.219000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "cve": "CVE-2026-56852",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-21T20:01:56.266823+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504233"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504233",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/794100",
          "url": "https://go.dev/cl/794100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80142",
          "url": "https://go.dev/issue/80142"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5970",
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "release_date": "2026-07-21T19:18:59.951000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "cve": "CVE-2026-56853",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:14:53.561638+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: Unencrypted HTTP/2 servers are susceptible to a denial of service due to improper handling of ReadHeaderTimeout during the client preface reading phase. This can lead to resource exhaustion and service unavailability in affected Red Hat products configured to support unencrypted HTTP/2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56853",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/795540",
          "url": "https://go.dev/cl/795540"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80205",
          "url": "https://go.dev/issue/80205"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6089",
          "url": "https://pkg.go.dev/vuln/GO-2026-6089"
        }
      ],
      "release_date": "2026-08-13T21:58:53.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "cve": "CVE-2026-56859",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:52.493058+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515840"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important denial of service flaw affects applications utilizing the Go `encoding/xml` package. This vulnerability arises from an issue in XML decoding where a recursion depth counter fails to reset, potentially leading to stack exhaustion when processing malicious XML input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515840",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56859",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803320",
          "url": "https://go.dev/cl/803320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80481",
          "url": "https://go.dev/issue/80481"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6088",
          "url": "https://pkg.go.dev/vuln/GO-2026-6088"
        }
      ],
      "release_date": "2026-08-13T21:58:52.959000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "cve": "CVE-2026-56860",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:13:18.319384+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory (\u0027..\u0027) segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments (\u0027..\u0027) may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803681",
          "url": "https://go.dev/cl/803681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80494",
          "url": "https://go.dev/issue/80494"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6218",
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "release_date": "2026-08-13T21:58:53.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "cve": "CVE-2026-56862",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-08-13T22:16:41.928450+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515839"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `golang` `crypto/tls` package. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515839",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/804261",
          "url": "https://go.dev/cl/804261"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80528",
          "url": "https://go.dev/issue/80528"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6090",
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "release_date": "2026-08-13T21:58:53.216000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "cve": "CVE-2026-59869",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-07-08T16:01:38.408322+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498122"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important. Red Hat products utilizing `js-yaml` to process untrusted YAML input are susceptible to a denial of service, as a remote attacker can provide a crafted document that consumes excessive CPU resources. This is considered Important due to the potential for service disruption without requiring authentication or complex attack vectors.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498122",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498122"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",
          "url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",
          "url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"
        }
      ],
      "release_date": "2026-07-08T15:15:54.675000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents"
    },
    {
      "cve": "CVE-2026-59873",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-08T16:01:31.576716+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498120"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: node-tar: Denial of Service via crafted gzip bomb",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in node-tar is rated as Important. A remote attacker can exploit the lack of strict limits on decompressed data and entry counts within the library\u0027s archive processing to craft a gzip bomb. This can lead to a denial of service by exhausting system resources such as disk space and CPU, making the affected system or application unavailable without requiring authentication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498120",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498120"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59873",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59873",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3",
          "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19",
          "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw",
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"
        }
      ],
      "release_date": "2026-07-08T15:22:40.077000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tar: node-tar: Denial of Service via crafted gzip bomb"
    },
    {
      "cve": "CVE-2026-59874",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-07-08T16:01:09.952291+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498116"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop, repeatedly parsing the same header and preventing further processing. This can lead to a denial of service (DoS) condition, making the affected system or application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: Node-tar: Denial of Service via malformed tar archive header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service flaw in node-tar affects Red Hat products that process untrusted tar archives. A remote attacker can provide a specially crafted archive with a malformed header, leading to an infinite loop during parsing and causing the application to become unresponsive. This can impact the availability of services relying on node-tar for archive manipulation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498116",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498116"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59874",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59874",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5",
          "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18",
          "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w",
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"
        }
      ],
      "release_date": "2026-07-08T15:23:47.527000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tar: Node-tar: Denial of Service via malformed tar archive header"
    },
    {
      "cve": "CVE-2026-67313",
      "discovery_date": "2026-08-01T13:03:08.824485+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67313",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67313"
        }
      ],
      "release_date": "2026-08-01T12:22:16.493000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON"
    },
    {
      "cve": "CVE-2026-67314",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:03:49.884962+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510030"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510030",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510030"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67314",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"
        }
      ],
      "release_date": "2026-08-01T12:22:16.603000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth"
    },
    {
      "cve": "CVE-2026-67320",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:01:50.659496+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509993"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509993",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509993"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67320",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc",
          "url": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter"
        }
      ],
      "release_date": "2026-08-01T12:22:17.547000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter"
    },
    {
      "cve": "CVE-2026-67321",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-01T13:02:49.231124+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510011"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This can lead to a denial of service, making the affected request path unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service via object serialization bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67321"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510011",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510011"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67321",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67321"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass",
          "url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass"
        }
      ],
      "release_date": "2026-08-01T12:22:18.177000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Denial of Service via object serialization bypass"
    },
    {
      "cve": "CVE-2026-69152",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-03T18:01:13.566423+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the brace-expansion library. The `expand()` function does not apply `maxLength` when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Any applications that pass user-controlled input to the `expand()` function are vulnerable to this issue. This flaw can result in an excessive consumption of memory that eventually terminates the process or blocks the event loop, both causing a denial of service. As this vulnerability allows a remote attacker to cause a denial of service, it has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69152",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
          "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
          "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
          "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
          "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"
        }
      ],
      "release_date": "2026-08-03T16:33:36.324000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, do not pass untrusted input to the expand() function.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation"
    },
    {
      "cve": "CVE-2026-69192",
      "cwe": {
        "id": "CWE-1389",
        "name": "Incorrect Parsing of Numbers with Different Radices"
      },
      "discovery_date": "2026-08-03T21:02:17.374935+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510801"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `ip-address` library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in the `ip-address` JavaScript library can lead to Server-Side Request Forgery (SSRF) and trust-boundary bypass. The library\u0027s inconsistent parsing of IP address octets with leading zeros, which it interprets as decimal while the network stack interprets them as octal, can cause applications to misclassify internal IP addresses as external. This discrepancy can bypass security filters designed to prevent access to internal resources.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510801",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510801"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69192",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e",
          "url": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1",
          "url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr",
          "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"
        }
      ],
      "release_date": "2026-08-03T19:56:13.640000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass"
    },
    {
      "cve": "CVE-2026-73088",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-11T17:11:53.228719+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514177"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Browserslist, a tool for sharing browser and Node.js versions. An attacker could provide specially crafted statistics data, which the tool processes without proper validation. This improper handling of untrusted data can lead to prototype pollution, potentially causing the application to crash and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "browserslist: Browserslist: Prototype pollution leading to denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability. The browserslist package, a front-end development tool, is vulnerable to prototype pollution when processing untrusted statistics data. This flaw can lead to a denial of service, as malicious input can crash applications that use the affected library. The impact is considered Important due to the potential for remote exploitation without authentication or user interaction, directly affecting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73088"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514177",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514177"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73088",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73088"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73088",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73088"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
          "url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/releases/tag/4.28.7",
          "url": "https://github.com/browserslist/browserslist/releases/tag/4.28.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
          "url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"
        }
      ],
      "release_date": "2026-08-11T17:00:05.869000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "To reduce exposure, ensure that the `browserslist` tool processes only trusted `browserslist-stats.json`, `opts.stats`, and CLI `--stats` data. Avoid using the tool with untrusted input sources in development or build environments. If `browserslist` is integrated into automated pipelines, validate all input data originates from trusted sources.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "browserslist: Browserslist: Prototype pollution leading to denial of service"
    },
    {
      "cve": "CVE-2026-73089",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-11T17:12:48.012036+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514195"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Browserslist, a configuration tool for front-end development. An attacker can exploit this vulnerability by influencing repeated query values, leading to unbounded memory growth. This issue can cause the application to consume excessive memory, resulting in an out-of-memory process crash and a Denial of Service (DoS) for affected systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `browserslist` library, which is used across several Red Hat products and services. The flaw allows an attacker to trigger unbounded memory growth by influencing query values, potentially leading to an out-of-memory crash and service unavailability. This is considered Important due to the potential for remote exploitation and significant impact on service stability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73089"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514195",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514195"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73089",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73089"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73089",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73089"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
          "url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/releases/tag/4.28.7",
          "url": "https://github.com/browserslist/browserslist/releases/tag/4.28.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
          "url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"
        }
      ],
      "release_date": "2026-08-11T17:05:38.760000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results"
    },
    {
      "cve": "CVE-2026-73566",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T17:51:27.686658+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515509"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could provide a specially crafted tar archive with a long-path header. When processing this archive with a non-empty member-selection list, an uncontrolled recursion in the `filesFilter` function can lead to a stack overflow. This issue results in a denial of service (DoS) by terminating Node.js applications that consume these archives.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: node-tar: Denial of Service via crafted long-path tar archive",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: A denial of service vulnerability exists in the `node-tar` library, affecting Node.js applications that process untrusted tar archives with member selection. A remote attacker could exploit this by providing a specially crafted archive containing excessively long paths, leading to an uncatchable stack overflow and termination of the consuming Node.js application. This is considered Important due to the potential for service disruption in applications handling untrusted archive content.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73566"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515509",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515509"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73566",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73566"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73566",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73566"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a",
          "url": "https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m",
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m"
        }
      ],
      "release_date": "2026-08-13T17:39:05.796000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tar: node-tar: Denial of Service via crafted long-path tar archive"
    },
    {
      "cve": "CVE-2026-73643",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-08-13T18:11:25.926202+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515531"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in js-yaml, a JavaScript YAML parser. A remote attacker could exploit this vulnerability by providing specially crafted YAML input containing nested flow collections. This can lead to exponential parsing time when the application processes untrusted input, consuming excessive CPU resources. This resource exhaustion can block the Node.js event loop and cause a Denial of Service (DoS) for the affected process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-yaml: js-yaml: Denial of Service via exponential parsing in flow collections",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial-of-service flaw in the `js-yaml` library, where processing specially crafted YAML input can lead to exponential parsing time. This can cause applications utilizing affected versions of `js-yaml` within Red Hat products to consume excessive CPU resources, potentially blocking the Node.js event loop and leading to service unavailability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73643"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515531",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515531"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73643",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73643"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73643",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73643"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853",
          "url": "https://github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5",
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5"
        }
      ],
      "release_date": "2026-08-13T17:47:30.404000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict applications from processing untrusted YAML input with affected versions of the `js-yaml` library. Implement strict input validation to ensure that only trusted and well-formed YAML data is processed. If the application is exposed to external, untrusted sources, consider isolating the application or implementing additional resource limits to prevent complete service disruption.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "js-yaml: js-yaml: Denial of Service via exponential parsing in flow collections"
    },
    {
      "cve": "CVE-2026-73646",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-08-17T15:41:38.584036+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517456"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted `sourceMappingURL` values in untrusted CSS files. This allows the attacker to disclose sensitive `sourcesContent` from arbitrary `.map` files accessible on the system, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "postcss: PostCSS: Information disclosure via path traversal in source map auto-loading",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73646"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517456",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517456"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73646",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73646"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73646",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73646"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c",
          "url": "https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/releases/tag/8.5.18",
          "url": "https://github.com/postcss/postcss/releases/tag/8.5.18"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849",
          "url": "https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849"
        }
      ],
      "release_date": "2026-08-17T15:35:13.518000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "postcss: PostCSS: Information disclosure via path traversal in source map auto-loading"
    },
    {
      "cve": "CVE-2026-75899",
      "cwe": {
        "id": "CWE-140",
        "name": "Improper Neutralization of Delimiters"
      },
      "discovery_date": "2026-08-24T09:51:05.559475+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2521778"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a loopback address. This vulnerability can lead to Server-Side Request Forgery (SSRF) and bypass host-based security policies.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in the `fast-uri` library, used by applications for URI parsing, allows for Server-Side Request Forgery (SSRF) and host-policy bypass. By crafting a doubly percent-encoded hostname in an untrusted HTTP-family URI, an attacker could redirect internal application requests to arbitrary network destinations, potentially bypassing security controls and accessing internal services. This risk is present in Red Hat products that process untrusted URIs using affected versions of `fast-uri`.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-75899"
        },
        {
          "category": "external",
          "summary": "RHBZ#2521778",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521778"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-75899",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75899"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75899",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75899"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf"
        }
      ],
      "release_date": "2026-08-24T09:40:19.801000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding"
    },
    {
      "cve": "CVE-2026-75931",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-08-24T09:51:02.191062+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2521777"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names (IDN) to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an application might validate a URI against a security policy using one hostname, but then resolve to a different, potentially malicious, hostname. This discrepancy could allow an attacker to bypass security policies and access unauthorized resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Host confusion via skipped IDN canonicalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-75931"
        },
        {
          "category": "external",
          "summary": "RHBZ#2521777",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521777"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-75931",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75931"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75931",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75931"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8"
        }
      ],
      "release_date": "2026-08-24T09:30:04.212000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Host confusion via skipped IDN canonicalization"
    },
    {
      "cve": "CVE-2026-75975",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2026-08-24T10:11:05.356309+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2521779"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri, a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not fully validate the IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. This can lead to a malformed, attacker-controlled host being normalized into a different, valid IPv6 destination, such as a local or private IPv6 target. An application normalizing untrusted URLs before outbound requests, redirects, or proxy routing could be redirected, resulting in a server-side request forgery (SSRF) and address-policy bypass.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-75975"
        },
        {
          "category": "external",
          "summary": "RHBZ#2521779",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521779"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-75975",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75975"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75975",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75975"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc"
        }
      ],
      "release_date": "2026-08-24T09:58:07.698000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization"
    },
    {
      "cve": "CVE-2026-76172",
      "cwe": {
        "id": "CWE-76",
        "name": "Improper Neutralization of Equivalent Special Elements"
      },
      "discovery_date": "2026-08-24T10:31:12.887477+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2521798"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri, a software component used for parsing Uniform Resource Identifiers (URIs) in Node.js applications. This vulnerability arises from an issue in how fast-uri processes the scheme part of a URI, specifically when it contains special characters that are percent-encoded. An attacker can exploit this by crafting a malicious URI, causing the parser to misinterpret the host, which can lead to serious security risks. These risks include unauthorized redirection to external websites, server-side request forgery (SSRF) where the application makes unintended requests to internal or external resources, and bypassing security policies.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-76172"
        },
        {
          "category": "external",
          "summary": "RHBZ#2521798",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521798"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-76172",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-76172"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76172",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76172"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp"
        }
      ],
      "release_date": "2026-08-24T10:07:56.440000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects"
    },
    {
      "cve": "CVE-2026-76844",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-08-24T13:23:01.901282+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2521896"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in webpack-dev-middleware. A remote attacker can exploit a path traversal vulnerability when the configured publicPath lacks a trailing slash. By sending a specially crafted request, the attacker can bypass a security guard, allowing the middleware to resolve files from one directory above the intended output path. This could lead to information disclosure if the middleware is configured to use the physical filesystem.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A path traversal flaw exists in webpack-dev-middleware when resolving URLs using a publicPath configuration lacking a trailing slash. By supplying a crafted URL with improper dot-dot positioning within a segment, an attacker can bypass the path traversal validation guard and offset calculation. When backed by a physical filesystem (writeToDisk enabled or custom outputFileSystem), this allows an unauthenticated remote attacker to read arbitrary files one directory level above the intended output directory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-76844"
        },
        {
          "category": "external",
          "summary": "RHBZ#2521896",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521896"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-76844",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-76844"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76844",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76844"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6",
          "url": "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6"
        },
        {
          "category": "external",
          "summary": "https://github.com/webpack/webpack-dev-middleware",
          "url": "https://github.com/webpack/webpack-dev-middleware"
        },
        {
          "category": "external",
          "summary": "https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js",
          "url": "https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath",
          "url": "https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath"
        }
      ],
      "release_date": "2026-08-24T13:12:01.148000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "Ensure that the configured publicPath always ends with a trailing slash (e.g., \u0027/assets/\u0027), or utilize the default setting (\u0027auto\u0027), which resolves to \u0027/\u0027 and is unmitigated by default. Alternatively, avoid backing the middleware with a physical filesystem (writeToDisk: false).",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal"
    },
    {
      "cve": "CVE-2026-82417",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-08-30T00:00:50.379994+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2525936"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in qs. The `qs.stringify` function, responsible for serializing objects, does not properly validate the `isBuffer` property of an object\u0027s constructor before attempting to invoke it. An unauthenticated attacker can provide specially crafted input that, when processed and then serialized by `qs.stringify`, triggers a `TypeError`. This vulnerability can lead to a Denial of Service (DoS), causing affected applications to return a 500 error or, in certain scenarios, terminate the application process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "qs: qs: Denial of Service via improper validation in stringify function",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A denial of service vulnerability was found in the qs package for Node.js. The stringify function does not verify that constructor.isBuffer is callable before invoking it. An attacker who can influence object shape, for example through query parameters parsed with allowPrototypes: true as Express 4 does by default, can cause qs.stringify to throw a TypeError when that data is re-serialized. In typical Node.js HTTP frameworks the error is caught per request and returns HTTP 500. In code paths without an error boundary, such as async handlers or background jobs, the process may exit.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-82417"
        },
        {
          "category": "external",
          "summary": "RHBZ#2525936",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525936"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-82417",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-82417"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-82417",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82417"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6",
          "url": "https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g",
          "url": "https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"
        }
      ],
      "release_date": "2026-08-29T23:51:27.634000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        },
        {
          "category": "workaround",
          "details": "If an immediate upgrade to qs 6.16.0 is not feasible, avoid re-serializing attacker-influenced parsed query or body objects with qs.stringify. Where qs.parse is used directly, set allowPrototypes: false unless prototype keys are required. For Express applications, review whether the default query parser configuration is necessary. Wrapping qs.stringify calls in try/catch can limit impact to individual requests.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "qs: qs: Denial of Service via improper validation in stringify function"
    },
    {
      "cve": "CVE-2026-84292",
      "cwe": {
        "id": "CWE-140",
        "name": "Improper Neutralization of Delimiters"
      },
      "discovery_date": "2026-09-02T20:21:15.599288+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2527747"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier (URI) without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker\u0027s host as legitimate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84292"
        },
        {
          "category": "external",
          "summary": "RHBZ#2527747",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527747"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84292",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84292"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84292",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84292"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3"
        }
      ],
      "release_date": "2026-09-02T20:09:51.415000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization"
    },
    {
      "cve": "CVE-2026-84375",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-09-01T21:51:30.205823+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2527118"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a denial of service (DoS) for applications that process untrusted YAML input.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in js-yaml, affecting applications that process untrusted YAML input. The flaw allows an attacker to craft a small YAML document that, when parsed, can lead to prolonged CPU consumption due to inefficient merge key processing, potentially exhausting system resources. This is particularly relevant where applications handle external YAML data and have merge processing enabled by default.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84375"
        },
        {
          "category": "external",
          "summary": "RHBZ#2527118",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527118"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84375",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84375"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84375",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84375"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
          "url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
          "url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
          "url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/pull/797",
          "url": "https://github.com/nodeca/js-yaml/pull/797"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"
        }
      ],
      "release_date": "2026-09-01T21:43:13.617000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing"
    },
    {
      "cve": "CVE-2026-84394",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-09-02T20:31:21.036047+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2527756"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier (URI) hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policies, such as Server-Side Request Forgery (SSRF) denylists or redirect allowlists, by causing an application to evaluate its policy against an incorrect host string. This could result in unintended network requests or access to unauthorized resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Moderate because successful exploitation requires a specific configuration where fast-uri handles security checks but a different client resolves the URL, enabling security policy bypasses without direct code execution. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3 (fixed in 2.4.6, 3.1.7, and 4.1.4).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84394"
        },
        {
          "category": "external",
          "summary": "RHBZ#2527756",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527756"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84394",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84394"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84394",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84394"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g"
        }
      ],
      "release_date": "2026-09-02T20:25:35.399000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T14:19:21+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68681"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.