Vulnerability-Lookup

RHSA-2026:70829

Vulnerability from csaf_redhat - Published: 2026-09-23 13:58 - Updated: 2026-09-25 18:08

Summary

Red Hat Security Advisory: RHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release

Severity

Important

Notes

Topic: The 1.3.8 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3

Details: The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19, 4.20 and 4.21

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-41178

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64	—	Vendor Fix fix

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64		—
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64		—

Threats

Impact Important

CVE-2026-45736

A flaw was found in ws, an open source WebSocket client and server for Node.js. The `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray` is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memory.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-824 - Access of Uninitialized Pointer

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64		—	Vendor Fix fix

Known not affected 9 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64		—
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64		—
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64		—
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64		—
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64		—
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64		—
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64		—
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64		—
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64		—

Threats

Impact Important

CVE-2026-48779

A flaw was found in ws, an open source WebSocket client and server. A remote attacker can exploit this memory exhaustion vulnerability by sending a high volume of exceptionally small fragments and data chunks. This action forces the affected component to allocate and hold structural wrappers that consume excessive memory. Consequently, this leads to process termination and a denial of service (DoS) for the remote peer.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 1 product, the same list as for CVE-2026-45736

Known not affected 9 products, the same list as for CVE-2026-45736

Threats

Impact Important

CVE-2026-56854

A flaw was found in golang.org/x/crypto/ssh. The component failed to properly enforce source-address restrictions for several authentication methods, including password and keyboard-interactive callbacks. In applications that misuse the ServerConfig.PublicKeyCallback callback to make security relevant authorization decisions, an attacker with a valid key could bypass network-based access controls to gain additional privileges.

6.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE-346 - Origin Validation Error

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64	—	Vendor Fix fix Workaround

Known not affected 7 products

Product	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64	—	Workaround

Threats

Impact Important

CVE-2026-59869

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-606 - Unchecked Input for Loop Condition

Affected products

Fixed 1 product, the same list as for CVE-2026-45736

Known not affected 9 products, the same list as for CVE-2026-45736

Threats

Impact Important

CVE-2026-73086

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the `nanoid(size)` function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-1241 - Use of Predictable Algorithm in Random Number Generator

Affected products

Fixed 1 product, the same list as for CVE-2026-45736

Known not affected 9 products, the same list as for CVE-2026-45736

Threats

Impact Important

CVE-2026-73088

A flaw was found in Browserslist, a tool for sharing browser and Node.js versions. An attacker could provide specially crafted statistics data, which the tool processes without proper validation. This improper handling of untrusted data can lead to prototype pollution, potentially causing the application to crash and resulting in a denial of service.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected products

Fixed 1 product, the same list as for CVE-2026-45736

Known not affected 9 products, the same list as for CVE-2026-45736

Threats

Impact Important

CVE-2026-73089

A flaw was found in Browserslist, a configuration tool for front-end development. An attacker can exploit this vulnerability by influencing repeated query values, leading to unbounded memory growth. This issue can cause the application to consume excessive memory, resulting in an out-of-memory process crash and a Denial of Service (DoS) for affected systems.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 1 product, the same list as for CVE-2026-45736

Known not affected 9 products, the same list as for CVE-2026-45736

Threats

Impact Important

CVE-2026-73500

A flaw was found in etcd, a distributed key-value store. A remote attacker can exploit this by opening numerous TCP connections to an etcd TLS listener without completing the TLS handshake. This action causes the `tlsListener.acceptLoop` to spawn an unbounded number of goroutines, which consume excessive memory. This resource exhaustion leads to a Denial of Service (DoS) for the etcd cluster and, consequently, for the Kubernetes control plane it supports.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64	—	Vendor Fix fix Workaround

Known not affected 6 products

Product	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64	—	Workaround

Threats

Impact Important

CVE-2026-73646

A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted `sourceMappingURL` values in untrusted CSS files. This allows the attacker to disclose sensitive `sourcesContent` from arbitrary `.map` files accessible on the system, leading to information disclosure.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 1 product, the same list as for CVE-2026-45736

Known not affected 9 products, the same list as for CVE-2026-45736

Threats

Impact Important

References

95 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:70829	self
https://access.redhat.com/documentation/en-us/red…	external
https://access.redhat.com/documentation/en-us/red…	external
https://access.redhat.com/security/cve/CVE-2026-41178	external
https://access.redhat.com/security/cve/CVE-2026-45736	external
https://access.redhat.com/security/cve/CVE-2026-48779	external
https://access.redhat.com/security/cve/CVE-2026-56854	external
https://access.redhat.com/security/cve/CVE-2026-59869	external
https://access.redhat.com/security/cve/CVE-2026-73086	external
https://access.redhat.com/security/cve/CVE-2026-73088	external
https://access.redhat.com/security/cve/CVE-2026-73089	external
https://access.redhat.com/security/cve/CVE-2026-73500	external
https://access.redhat.com/security/cve/CVE-2026-73646	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-41178	self
https://bugzilla.redhat.com/show_bug.cgi?id=2484830	external
https://www.cve.org/CVERecord?id=CVE-2026-41178	external
https://nvd.nist.gov/vuln/detail/CVE-2026-41178	external
https://github.com/open-telemetry/opentelemetry-g…	external
https://github.com/open-telemetry/opentelemetry-g…	external
https://access.redhat.com/security/cve/CVE-2026-45736	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477914	external
https://www.cve.org/CVERecord?id=CVE-2026-45736	external
https://nvd.nist.gov/vuln/detail/CVE-2026-45736	external
https://github.com/websockets/ws/commit/c0327ec15…	external
https://github.com/websockets/ws/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-48779	self
https://bugzilla.redhat.com/show_bug.cgi?id=2489661	external
https://www.cve.org/CVERecord?id=CVE-2026-48779	external
https://nvd.nist.gov/vuln/detail/CVE-2026-48779	external
https://github.com/websockets/ws/commit/86d3e8a5f…	external
https://github.com/websockets/ws/commit/b5372ac67…	external
https://github.com/websockets/ws/commit/bca91adf1…	external
https://github.com/websockets/ws/commit/fd36cd864…	external
https://github.com/websockets/ws/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-56854	self
https://bugzilla.redhat.com/show_bug.cgi?id=2525639	external
https://www.cve.org/CVERecord?id=CVE-2026-56854	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56854	external
https://go.dev/cl/797040	external
https://go.dev/issue/80213	external
https://pkg.go.dev/vuln/GO-2026-6303	external
https://access.redhat.com/security/cve/CVE-2026-59869	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498122	external
https://www.cve.org/CVERecord?id=CVE-2026-59869	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59869	external
https://github.com/nodeca/js-yaml/commit/24f13e79…	external
https://github.com/nodeca/js-yaml/commit/59423c6f…	external
https://github.com/nodeca/js-yaml/releases/tag/3.15.0	external
https://github.com/nodeca/js-yaml/releases/tag/4.3.0	external
https://github.com/nodeca/js-yaml/security/adviso…	external
https://access.redhat.com/security/cve/CVE-2026-73086	self
https://bugzilla.redhat.com/show_bug.cgi?id=2514175	external
https://www.cve.org/CVERecord?id=CVE-2026-73086	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73086	external
https://github.com/ai/nanoid/commit/7087969281cab…	external
https://github.com/ai/nanoid/commit/821dfed7b5db7…	external
https://github.com/ai/nanoid/commit/b0036ed60dc9f…	external
https://github.com/ai/nanoid/releases/tag/3.3.12	external
https://github.com/ai/nanoid/releases/tag/5.1.11	external
https://github.com/ai/nanoid/security/advisories/…	external
https://access.redhat.com/security/cve/CVE-2026-73088	self
https://bugzilla.redhat.com/show_bug.cgi?id=2514177	external
https://www.cve.org/CVERecord?id=CVE-2026-73088	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73088	external
https://github.com/browserslist/browserslist/comm…	external
https://github.com/browserslist/browserslist/rele…	external
https://github.com/browserslist/browserslist/secu…	external
https://access.redhat.com/security/cve/CVE-2026-73089	self
https://bugzilla.redhat.com/show_bug.cgi?id=2514195	external
https://www.cve.org/CVERecord?id=CVE-2026-73089	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73089	external
https://github.com/browserslist/browserslist/comm…	external
https://github.com/browserslist/browserslist/secu…	external
https://access.redhat.com/security/cve/CVE-2026-73500	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515007	external
https://www.cve.org/CVERecord?id=CVE-2026-73500	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73500	external
https://github.com/etcd-io/etcd/commit/2e07efce97…	external
https://github.com/etcd-io/etcd/commit/89ff6d5079…	external
https://github.com/etcd-io/etcd/commit/8e4dd0679a…	external
https://github.com/etcd-io/etcd/commit/f73cba7d92…	external
https://github.com/etcd-io/etcd/pull/22130	external
https://github.com/etcd-io/etcd/releases/tag/v3.5.33	external
https://github.com/etcd-io/etcd/releases/tag/v3.6.14	external
https://github.com/etcd-io/etcd/releases/tag/v3.7.1	external
https://github.com/etcd-io/etcd/security/advisori…	external
https://access.redhat.com/security/cve/CVE-2026-73646	self
https://bugzilla.redhat.com/show_bug.cgi?id=2517456	external
https://www.cve.org/CVERecord?id=CVE-2026-73646	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73646	external
https://github.com/postcss/postcss/commit/95663d3…	external
https://github.com/postcss/postcss/releases/tag/8.5.18	external
https://github.com/postcss/postcss/security/advis…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The 1.3.8 release of Red Hat Trusted Artifact Signer OpenShift Operator.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19, 4.20 and 4.21",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:70829",
        "url": "https://access.redhat.com/errata/RHSA-2026:70829"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41178",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41178"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45736",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45736"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48779",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48779"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56854",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56854"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59869",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73086",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73086"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73088",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73088"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73089",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73089"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73500",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73500"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73646",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73646"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70829.json"
      }
    ],
    "title": "Red Hat Security Advisory: RHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release",
    "tracking": {
      "current_release_date": "2026-09-25T18:08:45+00:00",
      "generator": {
        "date": "2026-09-25T18:08:45+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:70829",
      "initial_release_date": "2026-09-23T13:58:57+00:00",
      "revision_history": [
        {
          "date": "2026-09-23T13:58:57+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-23T13:58:59+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-25T18:08:45+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Trusted Artifact Signer 1.3",
                "product": {
                  "name": "Red Hat Trusted Artifact Signer 1.3",
                  "product_id": "Red Hat Trusted Artifact Signer 1.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Trusted Artifact Signer"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
                  "product_id": "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rekor-backfill-redis-rhel9@sha256%3A33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/rekor-backfill-redis-rhel9\u0026tag=1789645776"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
                  "product_id": "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/certificate-transparency-rhel9@sha256%3A3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/certificate-transparency-rhel9\u0026tag=1789655058"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
                  "product_id": "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/trillian-database-rhel9@sha256%3Ad6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/trillian-database-rhel9\u0026tag=1789645873"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
                  "product_id": "registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fulcio-rhel9@sha256%3Ac588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/fulcio-rhel9\u0026tag=1789716037"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
                  "product_id": "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/trillian-logserver-rhel9@sha256%3Afcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/trillian-logserver-rhel9\u0026tag=1789645873"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
                  "product_id": "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/trillian-logsigner-rhel9@sha256%3A814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/trillian-logsigner-rhel9\u0026tag=1789645873"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64",
                  "product_id": "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/trillian-redis-rhel9@sha256%3Aeebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/trillian-redis-rhel9\u0026tag=1789645873"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
                  "product_id": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rekor-search-ui-rhel9@sha256%3A7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/rekor-search-ui-rhel9\u0026tag=1789725818"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
                  "product_id": "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rekor-server-rhel9@sha256%3A0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/rekor-server-rhel9\u0026tag=1789645776"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
                  "product_id": "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/timestamp-authority-rhel9@sha256%3A694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/timestamp-authority-rhel9\u0026tag=1789645707"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-41178",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-04T16:01:10.300537+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484830"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in OpenTelemetry-Go, affecting versions 1.41.0 and 1.43.0. An attacker can exploit this flaw by sending oversized baggage headers, causing the `Parse` function to process invalid inputs and log errors, which can lead to resource exhaustion and service disruption in Red Hat products utilizing these affected OpenTelemetry-Go versions. The impact is considered Important due to the potential for remote, unauthenticated denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484830",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484830"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41178",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41178",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "https://github.com/open-telemetry/opentelemetry-go/pull/7880",
          "url": "https://github.com/open-telemetry/opentelemetry-go/pull/7880"
        },
        {
          "category": "external",
          "summary": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835",
          "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
        }
      ],
      "release_date": "2026-06-04T14:38:23.707000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T13:58:57+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70829"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers"
    },
    {
      "cve": "CVE-2026-45736",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-05-15T16:00:55.786944+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477914"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in ws, an open source WebSocket client and server for Node.js. The `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray` is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in the `ws` WebSocket library for Node.js could lead to sensitive information disclosure. The flaw occurs when a `TypedArray` is specifically provided as the `reason` argument to the `websocket.close()` function, potentially exposing uninitialized memory. Red Hat products utilizing this library may be affected if their implementations allow for such a crafted `close()` call.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45736"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477914",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477914"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45736",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45736"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45736",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45736"
        },
        {
          "category": "external",
          "summary": "https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086",
          "url": "https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"
        },
        {
          "category": "external",
          "summary": "https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx",
          "url": "https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx"
        }
      ],
      "release_date": "2026-05-15T14:53:57.263000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T13:58:57+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70829"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`"
    },
    {
      "cve": "CVE-2026-48779",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-06-16T22:01:24.571224+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2489661"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in ws, an open source WebSocket client and server. A remote attacker can exploit this memory exhaustion vulnerability by sending a high volume of exceptionally small fragments and data chunks. This action forces the affected component to allocate and hold structural wrappers that consume excessive memory. Consequently, this leads to process termination and a denial of service (DoS) for the remote peer.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `ws` WebSocket library. A remote attacker can exploit this flaw by sending a high volume of small, fragmented data, leading to excessive memory consumption and subsequent process termination. This can result in service disruption for Red Hat products that utilize `ws` for WebSocket communication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48779"
        },
        {
          "category": "external",
          "summary": "RHBZ#2489661",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489661"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48779",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48779"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48779",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48779"
        },
        {
          "category": "external",
          "summary": "https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7",
          "url": "https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7"
        },
        {
          "category": "external",
          "summary": "https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53",
          "url": "https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53"
        },
        {
          "category": "external",
          "summary": "https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94",
          "url": "https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94"
        },
        {
          "category": "external",
          "summary": "https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8",
          "url": "https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8"
        },
        {
          "category": "external",
          "summary": "https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p",
          "url": "https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p"
        }
      ],
      "release_date": "2026-06-16T21:26:22.537000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T13:58:57+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70829"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments"
    },
    {
      "cve": "CVE-2026-56854",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-08-28T15:33:34.404578+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2525639"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/crypto/ssh. The component failed to properly enforce source-address restrictions for several authentication methods, including password and keyboard-interactive callbacks. In applications that misuse the ServerConfig.PublicKeyCallback callback to make security relevant authorization decisions, an attacker with a valid key could bypass network-based access controls to gain additional privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability severity is Important due to the requirement that an attacker already have a valid private key. A flaw in golang.org/x/crypto/ssh allows remote attackers to bypass source-address restrictions for certain authentication methods. This would allow an attacker to use a valid key for gaining additional privileges outside of the bounds of the network-based access controls.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56854"
        },
        {
          "category": "external",
          "summary": "RHBZ#2525639",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525639"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56854",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56854"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56854",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56854"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/797040",
          "url": "https://go.dev/cl/797040"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80213",
          "url": "https://go.dev/issue/80213"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6303",
          "url": "https://pkg.go.dev/vuln/GO-2026-6303"
        }
      ],
      "release_date": "2026-08-28T15:14:26.918000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T13:58:57+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70829"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions"
    },
    {
      "cve": "CVE-2026-59869",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-07-08T16:01:38.408322+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498122"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important. Red Hat products utilizing `js-yaml` to process untrusted YAML input are susceptible to a denial of service, as a remote attacker can provide a crafted document that consumes excessive CPU resources. This is considered Important due to the potential for service disruption without requiring authentication or complex attack vectors.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498122",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498122"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",
          "url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",
          "url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"
        }
      ],
      "release_date": "2026-07-08T15:15:54.675000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T13:58:57+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70829"
        },
        {
          "category": "workaround",
          "details": "To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents"
    },
    {
      "cve": "CVE-2026-73086",
      "cwe": {
        "id": "CWE-1241",
        "name": "Use of Predictable Algorithm in Random Number Generator"
      },
      "discovery_date": "2026-08-11T17:11:45.607696+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514175"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the `nanoid(size)` function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nanoid: nanoid: Predictable ID generation due to integer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the nanoid JavaScript library allows a remote attacker to cause predictable ID generation by exploiting an integer overflow in the `nanoid(size)` function. This can lead to the compromise of session tokens, CSRF tokens, and API keys, bypassing security mechanisms. The attack requires specific conditions, contributing to its Important severity rather than Critical.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73086"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514175",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514175"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73086",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73086"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73086",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73086"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4",
          "url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3",
          "url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac",
          "url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/releases/tag/3.3.12",
          "url": "https://github.com/ai/nanoid/releases/tag/3.3.12"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/releases/tag/5.1.11",
          "url": "https://github.com/ai/nanoid/releases/tag/5.1.11"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w",
          "url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w"
        }
      ],
      "release_date": "2026-08-11T16:46:23.024000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T13:58:57+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70829"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nanoid: nanoid: Predictable ID generation due to integer overflow"
    },
    {
      "cve": "CVE-2026-73088",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-11T17:11:53.228719+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514177"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Browserslist, a tool for sharing browser and Node.js versions. An attacker could provide specially crafted statistics data, which the tool processes without proper validation. This improper handling of untrusted data can lead to prototype pollution, potentially causing the application to crash and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "browserslist: Browserslist: Prototype pollution leading to denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability. The browserslist package, a front-end development tool, is vulnerable to prototype pollution when processing untrusted statistics data. This flaw can lead to a denial of service, as malicious input can crash applications that use the affected library. The impact is considered Important due to the potential for remote exploitation without authentication or user interaction, directly affecting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73088"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514177",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514177"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73088",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73088"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73088",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73088"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
          "url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/releases/tag/4.28.7",
          "url": "https://github.com/browserslist/browserslist/releases/tag/4.28.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
          "url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"
        }
      ],
      "release_date": "2026-08-11T17:00:05.869000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T13:58:57+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70829"
        },
        {
          "category": "workaround",
          "details": "To reduce exposure, ensure that the `browserslist` tool processes only trusted `browserslist-stats.json`, `opts.stats`, and CLI `--stats` data. Avoid using the tool with untrusted input sources in development or build environments. If `browserslist` is integrated into automated pipelines, validate all input data originates from trusted sources.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "browserslist: Browserslist: Prototype pollution leading to denial of service"
    },
    {
      "cve": "CVE-2026-73089",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-11T17:12:48.012036+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514195"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Browserslist, a configuration tool for front-end development. An attacker can exploit this vulnerability by influencing repeated query values, leading to unbounded memory growth. This issue can cause the application to consume excessive memory, resulting in an out-of-memory process crash and a Denial of Service (DoS) for affected systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `browserslist` library, which is used across several Red Hat products and services. The flaw allows an attacker to trigger unbounded memory growth by influencing query values, potentially leading to an out-of-memory crash and service unavailability. This is considered Important due to the potential for remote exploitation and significant impact on service stability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73089"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514195",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514195"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73089",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73089"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73089",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73089"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
          "url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/releases/tag/4.28.7",
          "url": "https://github.com/browserslist/browserslist/releases/tag/4.28.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
          "url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"
        }
      ],
      "release_date": "2026-08-11T17:05:38.760000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T13:58:57+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70829"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results"
    },
    {
      "cve": "CVE-2026-73500",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-12T21:41:05.096460+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515007"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in etcd, a distributed key-value store. A remote attacker can exploit this by opening numerous TCP connections to an etcd TLS listener without completing the TLS handshake. This action causes the `tlsListener.acceptLoop` to spawn an unbounded number of goroutines, which consume excessive memory. This resource exhaustion leads to a Denial of Service (DoS) for the etcd cluster and, consequently, for the Kubernetes control plane it supports.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "etcd: etcd: Denial of Service via unbounded TLS handshake goroutines",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in etcd, a critical component for distributed systems and Kubernetes control planes. A remote attacker can exhaust etcd memory by initiating numerous incomplete TLS handshakes, leading to a loss of availability for affected clusters.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73500"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515007",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515007"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73500",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73500"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73500",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73500"
        },
        {
          "category": "external",
          "summary": "https://github.com/etcd-io/etcd/commit/2e07efce9745004eb4773cffaada9b5cdf77cff2",
          "url": "https://github.com/etcd-io/etcd/commit/2e07efce9745004eb4773cffaada9b5cdf77cff2"
        },
        {
          "category": "external",
          "summary": "https://github.com/etcd-io/etcd/commit/89ff6d50796049d4f1136915ba21504b76e7e372",
          "url": "https://github.com/etcd-io/etcd/commit/89ff6d50796049d4f1136915ba21504b76e7e372"
        },
        {
          "category": "external",
          "summary": "https://github.com/etcd-io/etcd/commit/8e4dd0679a2c6b095d2a32a749fda2521c7809a3",
          "url": "https://github.com/etcd-io/etcd/commit/8e4dd0679a2c6b095d2a32a749fda2521c7809a3"
        },
        {
          "category": "external",
          "summary": "https://github.com/etcd-io/etcd/commit/f73cba7d920019f91a1ea1f6697833e42731f057",
          "url": "https://github.com/etcd-io/etcd/commit/f73cba7d920019f91a1ea1f6697833e42731f057"
        },
        {
          "category": "external",
          "summary": "https://github.com/etcd-io/etcd/pull/22130",
          "url": "https://github.com/etcd-io/etcd/pull/22130"
        },
        {
          "category": "external",
          "summary": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33",
          "url": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33"
        },
        {
          "category": "external",
          "summary": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14",
          "url": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14"
        },
        {
          "category": "external",
          "summary": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1",
          "url": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3",
          "url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3"
        }
      ],
      "release_date": "2026-08-12T21:22:25.151000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T13:58:57+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70829"
        },
        {
          "category": "workaround",
          "details": "Restrict network access to the etcd TLS listener to only trusted clients and networks. Configure firewall rules to limit inbound connections to the etcd client port (default 2379) and peer port (default 2380) to authorized hosts. This reduces the attack surface by preventing untrusted network attackers from reaching the vulnerable service.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "etcd: etcd: Denial of Service via unbounded TLS handshake goroutines"
    },
    {
      "cve": "CVE-2026-73646",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-08-17T15:41:38.584036+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517456"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted `sourceMappingURL` values in untrusted CSS files. This allows the attacker to disclose sensitive `sourcesContent` from arbitrary `.map` files accessible on the system, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "postcss: PostCSS: Information disclosure via path traversal in source map auto-loading",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73646"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517456",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517456"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73646",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73646"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73646",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73646"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c",
          "url": "https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/releases/tag/8.5.18",
          "url": "https://github.com/postcss/postcss/releases/tag/8.5.18"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849",
          "url": "https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849"
        }
      ],
      "release_date": "2026-08-17T15:35:13.518000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T13:58:57+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70829"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3cd47987002faa665cd262011d3074b16fd31fdbc30168e6c03b3b0041196f37_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:c588a704915623f231507206b51432a4ebb13d12740ae503860bce6ebb19cfa3_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:33dfd44c85f4699fd4e6976128846c7bc28114c3e0c01ff9c99aa2ece0daba50_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:0c037fba9d943c6a54bdec1cd96114ec4a55c0f3d67c15e3a6df387b85f024f9_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:694ac391493b38e6332997d5bea5081f42e108665deb7d94da985222cb57ebae_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:d6bce7c3d1ef3e6b65afc44f6cdf7c86ec4924325a4584c914b6d1a102ce2a7a_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:fcf18899f2e831f2d0d418f2ca571f3f39c784d6d1a1694c85d8480dcc7d3ee1_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:814d7fe782bb18a0a3efa8bb79810ec0ac8c8925038b25125c7cc587f2a4fa14_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:eebfd2e7e0472bcc123aa9f41c17ff6fc531e1d76af8fb78c3c385d457a38e8a_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "postcss: PostCSS: Information disclosure via path traversal in source map auto-loading"
    }
  ]
}

CVE-2026-41178 (GCVE-0-2026-41178)

Vulnerability from cvelistv5 – Published: 2026-06-04 14:38 – Updated: 2026-06-04 15:46

Title

OpenTelemetry-Go's baggage parsing no longer caps raw header length

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-04 15:46 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
open-telemetry	go.opentelemetry.io/otel/baggage	Affected: = 1.41.0 Affected: = 1.43.0
open-telemetry	go.opentelemetry.io/otel/propagation	Affected: = 1.41.0 Affected: = 1.43.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41178",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T15:46:06.715583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-04T15:46:11.923Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go.opentelemetry.io/otel/baggage",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.41.0"
            },
            {
              "status": "affected",
              "version": "= 1.43.0"
            }
          ]
        },
        {
          "product": "go.opentelemetry.io/otel/propagation",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.41.0"
            },
            {
              "status": "affected",
              "version": "= 1.43.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T14:38:23.707Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/pull/7880",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/pull/7880"
        }
      ],
      "source": {
        "advisory": "GHSA-5wrp-cwcj-q835",
        "discovery": "UNKNOWN"
      },
      "title": "OpenTelemetry-Go\u0027s baggage parsing no longer caps raw header length"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41178",
    "datePublished": "2026-06-04T14:38:23.707Z",
    "dateReserved": "2026-04-17T16:34:45.526Z",
    "dateUpdated": "2026-06-04T15:46:11.923Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45736 (GCVE-0-2026-45736)

Vulnerability from cvelistv5 – Published: 2026-05-15 14:53 – Updated: 2026-09-11 12:09

Title

ws: Uninitialized memory disclosure

Summary

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-16 01:08 UTC

CWE

CWE-908 - Use of Uninitialized Resource
CWE-824 - Access of Uninitialized Pointer

Assigner

GitHub_M mitre root

References

32 references

URL	Tags
https://github.com/websockets/ws/security/advisor…	x_refsource_CONFIRM
https://github.com/websockets/ws/commit/c0327ec15…	x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-45736	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2477914	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:48151	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57590	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66545	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66488	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34374	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36754	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33574	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29197	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26638	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26994	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27171	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7655	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41928	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65126	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60520	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44235	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44263	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44267	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40792	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:48693	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40768	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36820	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56431	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56366	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57013	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56928	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:37272	vendor-advisoryx_refsource_REDHAT

Impacted products

150 products

Vendor	Product	Version
websockets	ws	Affected: >= 8.0.0, < 8.20.1
Red Hat	Cryostat 4 on RHEL 9	Unaffected: 4.2.0-13 , < * (rpm) cpe:/a:redhat:cryostat:4::el9
Red Hat	Red Hat AMQ Broker 7.13.6	cpe:/a:redhat:amq_broker:7.13
Red Hat	Red Hat AMQ Broker 7.14.1	cpe:/a:redhat:amq_broker:7.14
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:1.1.2-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Ansible Automation Platform 2.6	Unaffected: 1782761510 , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.6::el9
Red Hat	Red Hat Developer Hub 1.10	Unaffected: 1783448184 , < * (rpm) cpe:/a:redhat:rhdh:1.10::el9
Red Hat	Red Hat Developer Hub 1.9	Unaffected: 1782761244 , < * (rpm) cpe:/a:redhat:rhdh:1.9::el9
Red Hat	Red Hat Discovery 2	Unaffected: 1782166952 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Hardened Images	Unaffected: 10.0.109-1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 8.0.128-1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 9.0.118-1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 1.22.22-18.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Migration Toolkit 1.8	Unaffected: 1783690532 , < * (rpm) cpe:/a:redhat:rhmt:1.8::el8
Red Hat	Red Hat OpenShift AI 2.25	Unaffected: 1787801527 , < * (rpm) cpe:/a:redhat:openshift_ai:2.25::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787347991 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787250508 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787251550 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1786611759 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787251250 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787250617 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787121387 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 1784670101 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	Red Hat OpenShift Container Platform 4.20	Unaffected: 1784724699 , < * (rpm) cpe:/a:redhat:openshift:4.20::el9
Red Hat	Red Hat OpenShift Container Platform 4.20	Unaffected: 1784730857 , < * (rpm) cpe:/a:redhat:openshift:4.20::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 1784127553 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 1784713741 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift Container Platform 4.22	Unaffected: 1784144936 , < * (rpm) cpe:/a:redhat:openshift:4.22::el9
Red Hat	Red Hat OpenShift Container Platform 4.22	Unaffected: 1785230147 , < * (rpm) cpe:/a:redhat:openshift:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786705347 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706101 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786705558 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786705646 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706138 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786705741 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786705777 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786705802 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786705938 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706577 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706125 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706177 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706188 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706679 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706357 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706612 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706644 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706659 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706880 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786701839 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786701555 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702052 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702559 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702713 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702264 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702448 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702276 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702440 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702315 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786703071 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702563 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702636 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702623 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786703137 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702716 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702872 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702949 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702917 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786703143 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786627460 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786626399 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786628235 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786627106 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786629761 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786627559 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786687918 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786629478 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786628142 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786631508 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786628053 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786627382 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786627430 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786629076 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786627469 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786644072 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786688215 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786628340 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786628623 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786632256 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786628935 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786629548 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787057250 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787057964 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787057603 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787058450 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787057989 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787059853 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787057849 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787060257 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787058278 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787058658 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787058706 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787058403 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787059072 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787058807 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787058588 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787058970 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787059538 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787059616 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787061098 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787059085 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787059621 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787059386 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787060080 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787060105 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787059493 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787060201 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787060274 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1787061554 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.29	Unaffected: 1782498475 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.29::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.29	Unaffected: 1782498792 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.29::el9
Red Hat	Red Hat Trusted Artifact Signer 1.4	Unaffected: 1783327185 , < * (rpm) cpe:/a:redhat:trusted_artifact_signer:1.4::el9
Red Hat	Cryostat 4	cpe:/a:redhat:cryostat:4
Red Hat	Gatekeeper 3	cpe:/a:redhat:gatekeeper:3
Red Hat	Node HealthCheck Operator	cpe:/a:redhat:workload_availability_nhc:0
Red Hat	OpenShift Lightspeed	cpe:/a:redhat:openshift_lightspeed
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	OpenShift Service Mesh 2	cpe:/a:redhat:service_mesh:2
Red Hat	OpenShift Service Mesh 3	cpe:/a:redhat:service_mesh:3
Red Hat	Red Hat Ansible Automation Platform 2	cpe:/a:redhat:ansible_automation_platform:2
Red Hat	Red Hat build of Apache Camel for Spring Boot 4	cpe:/a:redhat:camel_spring_boot:4
Red Hat	Red Hat build of Apache Camel - HawtIO 4	cpe:/a:redhat:apache_camel_hawtio:4
Red Hat	Red Hat Build of Keycloak	cpe:/a:redhat:build_keycloak:
Red Hat	Red Hat Build of Podman Desktop	cpe:/a:redhat:podman_desktop:1
Red Hat	Red Hat Build of Podman Desktop - Tech Preview	cpe:/a:redhat:podman_desktop:0
Red Hat	Red Hat Connectivity Link 1	cpe:/a:redhat:connectivity_link:1
Red Hat	Red Hat Data Grid 8	cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	cpe:/a:redhat:enterprise_linux_ai:3
Red Hat	Red Hat Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat JBoss Enterprise Application Platform 8	cpe:/a:redhat:jboss_enterprise_application_platform:8
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat Quay 3	cpe:/a:redhat:quay:3
Red Hat	Red Hat Satellite 6	cpe:/a:redhat:satellite:6
Red Hat	Self-service automation portal 2	cpe:/a:redhat:ansible_portal:2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45736",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-16T01:08:38.777055Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-16T01:09:15.903Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-openshift-console-plugin-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7.13"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ws",
            "product": "Red Hat AMQ Broker 7.13.6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7.14"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ws",
            "product": "Red Hat AMQ Broker 7.14.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "rh-podman-desktop",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.1.2-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform-26/gateway-rhel9",
            "product": "Red Hat Ansible Automation Platform 2.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782761510",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-hub-rhel9",
            "product": "Red Hat Developer Hub 1.10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783448184",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-hub-rhel9",
            "product": "Red Hat Developer Hub 1.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782761244",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:discovery:2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "discovery/discovery-ui-rhel9",
            "product": "Red Hat Discovery 2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782166952",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "dotnet10-0-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "10.0.109-1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "dotnet8-0-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8.0.128-1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "dotnet9-0-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9.0.118-1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "yarnpkg-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.22.22-18.1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhmt:1.8::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhmtc/openshift-migration-ui-rhel8",
            "product": "Red Hat Migration Toolkit 1.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783690532",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787801527",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-dashboard-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787347991",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-automl-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787250508",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-autorag-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787251550",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786611759",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-maas-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787251250",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-model-registry-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787250617",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787121387",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-monitoring-plugin-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784670101",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-agent-installer-ui-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784724699",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-monitoring-plugin-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784730857",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-monitoring-plugin-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784127553",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-agent-installer-ui-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784713741",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-monitoring-plugin-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784144936",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-agent-installer-ui-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785230147",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705347",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706101",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-core-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705558",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705646",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706138",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705741",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-metrics-exporter-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705777",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705802",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cli-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705938",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706577",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cosi-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706125",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706177",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706188",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706679",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706357",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-must-gather-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706612",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706644",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odr-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706659",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/rook-ceph-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706880",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786701839",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786701555",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-core-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702052",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702559",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702713",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702264",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-metrics-exporter-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702448",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702276",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cli-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702440",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cloudnative-pg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702315",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786703071",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cosi-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702563",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702636",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702623",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786703137",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702716",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-must-gather-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702872",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702949",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odr-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702917",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/rook-ceph-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786703143",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627460",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786626399",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-core-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628235",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627106",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786629761",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627559",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-metrics-exporter-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786687918",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786629478",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cli-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628142",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cloudnative-pg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786631508",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628053",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cosi-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627382",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627430",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786629076",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-external-snapshotter-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627469",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-external-snapshotter-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786644072",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786688215",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628340",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-must-gather-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628623",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786632256",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odr-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628935",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/rook-ceph-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786629548",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787057250",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787057964",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/devicefinder-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787057603",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-core-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787058450",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787057989",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787059853",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787057849",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-metrics-exporter-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787060257",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787058278",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-blackbox-exporter-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787058658",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cli-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787058706",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cloudnative-pg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787058403",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787059072",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cosi-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787058807",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787058588",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787058970",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-drbd-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787059538",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-external-snapshotter-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787059616",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-external-snapshotter-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787061098",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-lightspeed-rag-content-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787059085",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787059621",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787059386",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-must-gather-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787060080",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787060105",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odr-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787059493",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odr-volsync-plugin-mover-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787060201",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odr-volsync-plugin-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787060274",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/rook-ceph-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787061554",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/code-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782498475",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/dashboard-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782498792",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhtas/rekor-search-ui-rhel9",
            "product": "Red Hat Trusted Artifact Signer 1.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783327185",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "cryostat-openshift-console-plugin-npm",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana-infinity-datasource-npm",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ws",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:gatekeeper:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "gatekeeper/gatekeeper-rhel9",
            "product": "Gatekeeper 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/node-healthcheck-must-gather-rhel9",
            "product": "Node HealthCheck Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/node-healthcheck-operator-bundle",
            "product": "Node HealthCheck Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/node-healthcheck-rhel9-operator",
            "product": "Node HealthCheck Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_lightspeed"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-lightspeed/lightspeed-console-plugin-419-rhel9",
            "product": "OpenShift Lightspeed",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_lightspeed"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9",
            "product": "OpenShift Lightspeed",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_lightspeed"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-lightspeed/lightspeed-console-plugin-rhel9",
            "product": "OpenShift Lightspeed",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-console-plugin-pf5-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-console-plugin-rhel8",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-console-plugin-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-hub-ui-rhel8",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-hub-ui-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-service-mesh/kiali-ossmc-rhel8",
            "product": "OpenShift Service Mesh 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-service-mesh/kiali-rhel8",
            "product": "OpenShift Service Mesh 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-service-mesh/kiali-operator-bundle",
            "product": "OpenShift Service Mesh 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-service-mesh/kiali-ossmc-rhel9",
            "product": "OpenShift Service Mesh 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-service-mesh/kiali-rhel9",
            "product": "OpenShift Service Mesh 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-service-mesh/kiali-rhel9-operator",
            "product": "OpenShift Service Mesh 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform-24/lightspeed-rhel8",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform-25/lightspeed-rhel8",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform-26/lightspeed-rhel9",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform-27/lightspeed-rhel9",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "affected",
            "packageName": "automation-controller",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "affected",
            "packageName": "automation-eda-controller",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_spring_boot:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ws",
            "product": "Red Hat build of Apache Camel for Spring Boot 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_hawtio:4"
            ],
            "defaultStatus": "affected",
            "packageName": "ws",
            "product": "Red Hat build of Apache Camel - HawtIO 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ws",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:podman_desktop:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rh-podman-desktop.git",
            "product": "Red Hat Build of Podman Desktop",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:podman_desktop:0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdesktop/rh-podman-desktop-ext-bootc-rhel10",
            "product": "Red Hat Build of Podman Desktop - Tech Preview",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:podman_desktop:0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdesktop/rh-podman-desktop-ext-rhel-rhel10",
            "product": "Red Hat Build of Podman Desktop - Tech Preview",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:podman_desktop:0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdesktop/rh-podman-desktop-ext-sandbox-rhel10",
            "product": "Red Hat Build of Podman Desktop - Tech Preview",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:connectivity_link:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcl-1/rhcl-console-plugin-rhel9",
            "product": "Red Hat Connectivity Link 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "affected",
            "packageName": "ws",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet8.0",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet9.0",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "pcs",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rust",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet5.0-build-reference-packages",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet8.0",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet9.0",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana-pcp",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "mozjs60",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "pcs",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rust",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "ceph",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet8.0",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet9.0",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "gjs",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "pcs",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rust",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-gaudi-rhel9",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-rocm-rhel9",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/disk-image-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rust",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "thrift",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ws",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ruff",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rust",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ws",
            "product": "Red Hat JBoss Enterprise Application Platform 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ws",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-mlflow-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-eval-hub-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-mod-arch-mlflow-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-agent-installer-ui-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/ose-console",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/ose-console-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-native-virtualization/kubevirt-console-plugin",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-native-virtualization/kubevirt-console-plugin-rhel9",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quay:3"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "affected",
            "packageName": "satellite/iop-vulnerability-frontend-rhel9",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_portal:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform/automation-portal",
            "product": "Self-service automation portal 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_portal:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform/bootc-automation-portal-rhel9",
            "product": "Self-service automation portal 2",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-15T14:53:57.263Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in ws, an open source WebSocket client and server for Node.js. The `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray` is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memory."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-824",
                "description": "Access of Uninitialized Pointer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T12:09:09.123Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-45736"
          },
          {
            "name": "RHBZ#2477914",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477914"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45736.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:48151"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57590"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66545"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66488"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34374"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36754"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33574"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29197"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26638"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26994"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27171"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7655"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41928"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65126"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60520"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44235"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44263"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44267"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40792"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:48693"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40768"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36820"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56431"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56366"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57013"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56928"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37272"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:48151: Cryostat 4 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57590: Red Hat Enterprise Linux Extensions Channel (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66545: Red Hat AMQ Broker 7.13.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66488: Red Hat AMQ Broker 7.14.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34374: Red Hat Ansible Automation Platform 2.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36754: Red Hat Developer Hub 1.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33574: Red Hat Developer Hub 1.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29197: Red Hat Discovery 2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26638: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26994: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27171: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7655: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41928: Red Hat Migration Toolkit 1.8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65126: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60520: Red Hat OpenShift AI 3.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44235: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44263: Red Hat OpenShift Container Platform 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44267: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40792: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:48693: Red Hat OpenShift Container Platform 4.22"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40768: Red Hat OpenShift Container Platform 4.22"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56431: Red Hat Openshift Data Foundation 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56366: Red Hat Openshift Data Foundation 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57013: Red Hat Openshift Data Foundation 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56928: Red Hat Openshift Data Foundation 4.22"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37272: Red Hat Trusted Artifact Signer 1.4"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-15T16:00:55.786Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-15T14:53:57.263Z",
            "value": "Made public."
          }
        ],
        "title": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ws",
          "vendor": "websockets",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.20.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-908",
              "description": "CWE-908: Use of Uninitialized Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-15T14:53:57.263Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx"
        },
        {
          "name": "https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"
        }
      ],
      "source": {
        "advisory": "GHSA-58qx-3vcg-4xpx",
        "discovery": "UNKNOWN"
      },
      "title": "ws: Uninitialized memory disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45736",
    "datePublished": "2026-05-15T14:53:57.263Z",
    "dateReserved": "2026-05-13T06:54:34.219Z",
    "dateUpdated": "2026-09-11T12:09:09.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48779 (GCVE-0-2026-48779)

Vulnerability from cvelistv5 – Published: 2026-06-16 21:26 – Updated: 2026-09-11 12:09

Title

ws: Memory exhaustion DoS from tiny fragments and data chunks

Summary

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-17 18:07 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling
CWE-1050 - Excessive Platform Resource Consumption within a Loop

Assigner

GitHub_M mitre root

References

32 references

URL	Tags
https://github.com/websockets/ws/security/advisor…	x_refsource_CONFIRM
https://github.com/websockets/ws/commit/86d3e8a5f…	x_refsource_MISC
https://github.com/websockets/ws/commit/b5372ac67…	x_refsource_MISC
https://github.com/websockets/ws/commit/bca91adf1…	x_refsource_MISC
https://github.com/websockets/ws/commit/fd36cd864…	x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-48779	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2489661	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:48151	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34342	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57590	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66545	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66488	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36754	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33574	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29197	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41928	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65126	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60520	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36820	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33155	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33160	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33163	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33173	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33183	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56431	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41941	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41944	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56366	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57013	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40984	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:37272	vendor-advisoryx_refsource_REDHAT

Impacted products

131 products

Vendor	Product	Version
websockets	ws	Affected: >= 1.1.0, < 5.2.5 Affected: >= 6.0.0, < 6.2.4 Affected: >= 7.0.0, < 7.5.11 Affected: >= 8.0.0, < 8.21.0
Red Hat	Cryostat 4 on RHEL 9	Unaffected: 4.2.0-13 , < * (rpm) cpe:/a:redhat:cryostat:4::el9
Red Hat	Red Hat AMQ Broker 7.13.6	cpe:/a:redhat:amq_broker:7.13
Red Hat	Red Hat AMQ Broker 7.14.1	cpe:/a:redhat:amq_broker:7.14
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:1.1.2-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782840519 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839981 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839193 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782838753 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839279 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782840539 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782841925 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782844225 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839658 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782838476 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839996 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839494 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Red Hat Developer Hub 1.10	Unaffected: 1783448184 , < * (rpm) cpe:/a:redhat:rhdh:1.10::el9
Red Hat	Red Hat Developer Hub 1.9	Unaffected: 1782761244 , < * (rpm) cpe:/a:redhat:rhdh:1.9::el9
Red Hat	Red Hat Discovery 2	Unaffected: 1782166952 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Migration Toolkit 1.8	Unaffected: 1783690532 , < * (rpm) cpe:/a:redhat:rhmt:1.8::el8
Red Hat	Red Hat OpenShift AI 2.25	Unaffected: 1787801527 , < * (rpm) cpe:/a:redhat:openshift_ai:2.25::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787347991 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787250508 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787251550 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1786611759 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787251250 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787250617 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787121387 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1783676191 , < * (rpm) Unaffected: 1786705347 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1783929816 , < * (rpm) Unaffected: 1786706101 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1784094353 , < * (rpm) Unaffected: 1786705558 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1784093953 , < * (rpm) Unaffected: 1786705646 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1784094943 , < * (rpm) Unaffected: 1786706138 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1783676585 , < * (rpm) Unaffected: 1786705741 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1783676649 , < * (rpm) Unaffected: 1786705777 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1783676675 , < * (rpm) Unaffected: 1786705802 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1784094299 , < * (rpm) Unaffected: 1786705938 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1784094725 , < * (rpm) Unaffected: 1786706577 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1783676820 , < * (rpm) Unaffected: 1786706125 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1783676883 , < * (rpm) Unaffected: 1786706177 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1783676894 , < * (rpm) Unaffected: 1786706188 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1784095175 , < * (rpm) Unaffected: 1786706679 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1783676977 , < * (rpm) Unaffected: 1786706357 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1784093503 , < * (rpm) Unaffected: 1786706612 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1783677297 , < * (rpm) Unaffected: 1786706644 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1783677345 , < * (rpm) Unaffected: 1786706659 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1783677533 , < * (rpm) Unaffected: 1786706880 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1783684360 , < * (rpm) Unaffected: 1786701839 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1783684068 , < * (rpm) Unaffected: 1786701555 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1784054582 , < * (rpm) Unaffected: 1786702052 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1784054606 , < * (rpm) Unaffected: 1786702559 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1784055295 , < * (rpm) Unaffected: 1786702713 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1783684603 , < * (rpm) Unaffected: 1786702264 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1783684668 , < * (rpm) Unaffected: 1786702448 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1783684667 , < * (rpm) Unaffected: 1786702276 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1784054873 , < * (rpm) Unaffected: 1786702440 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1783684707 , < * (rpm) Unaffected: 1786702315 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1784055589 , < * (rpm) Unaffected: 1786703071 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1783684779 , < * (rpm) Unaffected: 1786702563 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1783684831 , < * (rpm) Unaffected: 1786702636 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1783684839 , < * (rpm) Unaffected: 1786702623 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1784055533 , < * (rpm) Unaffected: 1786703137 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1784055558 , < * (rpm) Unaffected: 1786702716 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1784056134 , < * (rpm) Unaffected: 1786702872 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1783685128 , < * (rpm) Unaffected: 1786702949 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1783685129 , < * (rpm) Unaffected: 1786702917 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1783685375 , < * (rpm) Unaffected: 1786703143 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667125 , < * (rpm) Unaffected: 1786627460 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783666755 , < * (rpm) Unaffected: 1786626399 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1784054598 , < * (rpm) Unaffected: 1786628235 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1784055387 , < * (rpm) Unaffected: 1786627106 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1784055726 , < * (rpm) Unaffected: 1786629761 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667517 , < * (rpm) Unaffected: 1786627559 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667577 , < * (rpm) Unaffected: 1786687918 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667611 , < * (rpm) Unaffected: 1786629478 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1784055020 , < * (rpm) Unaffected: 1786628142 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667641 , < * (rpm) Unaffected: 1786631508 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1784055586 , < * (rpm) Unaffected: 1786628053 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667790 , < * (rpm) Unaffected: 1786627382 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667859 , < * (rpm) Unaffected: 1786627430 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667875 , < * (rpm) Unaffected: 1786629076 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667869 , < * (rpm) Unaffected: 1786627469 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667877 , < * (rpm) Unaffected: 1786644072 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1784055576 , < * (rpm) Unaffected: 1786688215 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1784055244 , < * (rpm) Unaffected: 1786628340 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1784055382 , < * (rpm) Unaffected: 1786628623 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783668266 , < * (rpm) Unaffected: 1786632256 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783668288 , < * (rpm) Unaffected: 1786628935 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783669219 , < * (rpm) Unaffected: 1786629548 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.29	Unaffected: 1782498475 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.29::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.29	Unaffected: 1782498792 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.29::el9
Red Hat	Red Hat OpenShift Service Mesh 2.6	Unaffected: 1781937133 , < * (rpm) cpe:/a:redhat:service_mesh:2.6::el8
Red Hat	Red Hat OpenShift Service Mesh 2.6	Unaffected: 1782287580 , < * (rpm) cpe:/a:redhat:service_mesh:2.6::el8
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1782201894 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1782201833 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1782201696 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1782201537 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1782201851 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1782201812 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1782231869 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1782201466 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat Trusted Artifact Signer 1.4	Unaffected: 1783327185 , < * (rpm) cpe:/a:redhat:trusted_artifact_signer:1.4::el9
Red Hat	Cryostat 4	cpe:/a:redhat:cryostat:4
Red Hat	Gatekeeper 3	cpe:/a:redhat:gatekeeper:3
Red Hat	Node HealthCheck Operator	cpe:/a:redhat:workload_availability_nhc:0
Red Hat	OpenShift Lightspeed	cpe:/a:redhat:openshift_lightspeed
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	OpenShift Service Mesh 3	cpe:/a:redhat:service_mesh:3
Red Hat	Red Hat Ansible Automation Platform 2	cpe:/a:redhat:ansible_automation_platform:2
Red Hat	Red Hat build of Apache Camel for Spring Boot 4	cpe:/a:redhat:camel_spring_boot:4
Red Hat	Red Hat build of Apache Camel - HawtIO 4	cpe:/a:redhat:apache_camel_hawtio:4
Red Hat	Red Hat Build of Keycloak	cpe:/a:redhat:build_keycloak:
Red Hat	Red Hat Build of Podman Desktop	cpe:/a:redhat:podman_desktop:1
Red Hat	Red Hat Build of Podman Desktop - Tech Preview	cpe:/a:redhat:podman_desktop:0
Red Hat	Red Hat Connectivity Link 1	cpe:/a:redhat:connectivity_link:1
Red Hat	Red Hat Data Grid 8	cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	cpe:/a:redhat:enterprise_linux_ai:3
Red Hat	Red Hat Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat JBoss Enterprise Application Platform 8	cpe:/a:redhat:jboss_enterprise_application_platform:8
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat Quay 3	cpe:/a:redhat:quay:3
Red Hat	Red Hat Satellite 6	cpe:/a:redhat:satellite:6
Red Hat	Self-service automation portal 2	cpe:/a:redhat:ansible_portal:2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48779",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T18:07:28.748295Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T18:12:48.129Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-openshift-console-plugin-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7.13"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ws",
            "product": "Red Hat AMQ Broker 7.13.6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7.14"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ws",
            "product": "Red Hat AMQ Broker 7.14.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "rh-podman-desktop",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.1.2-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782840519",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839981",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839193",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/distributed-tracing-console-plugin-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782838753",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/logging-console-plugin-pf4-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839279",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/logging-console-plugin-pf5-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782840539",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/logging-console-plugin-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782841925",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/monitoring-console-plugin-pf5-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782844225",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/monitoring-console-plugin-pf6-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839658",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/monitoring-console-plugin-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782838476",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839996",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839494",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-hub-rhel9",
            "product": "Red Hat Developer Hub 1.10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783448184",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-hub-rhel9",
            "product": "Red Hat Developer Hub 1.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782761244",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:discovery:2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "discovery/discovery-ui-rhel9",
            "product": "Red Hat Discovery 2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782166952",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhmt:1.8::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhmtc/openshift-migration-ui-rhel8",
            "product": "Red Hat Migration Toolkit 1.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783690532",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787801527",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-dashboard-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787347991",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-automl-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787250508",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-autorag-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787251550",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786611759",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-maas-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787251250",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-model-registry-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787250617",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787121387",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783676191",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705347",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783929816",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706101",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-core-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784094353",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705558",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784093953",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705646",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784094943",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706138",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783676585",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705741",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-metrics-exporter-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783676649",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705777",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783676675",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705802",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cli-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784094299",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705938",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784094725",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706577",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cosi-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783676820",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706125",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783676883",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706177",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783676894",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706188",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784095175",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706679",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783676977",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706357",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-must-gather-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784093503",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706612",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783677297",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706644",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odr-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783677345",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706659",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/rook-ceph-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783677533",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706880",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783684360",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786701839",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783684068",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786701555",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-core-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784054582",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702052",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784054606",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702559",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055295",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702713",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783684603",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702264",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-metrics-exporter-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783684668",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702448",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783684667",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702276",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cli-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784054873",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702440",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cloudnative-pg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783684707",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702315",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055589",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786703071",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cosi-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783684779",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702563",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783684831",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702636",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783684839",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702623",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055533",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786703137",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055558",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702716",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-must-gather-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784056134",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702872",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783685128",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702949",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odr-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783685129",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702917",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/rook-ceph-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783685375",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786703143",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667125",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627460",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783666755",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786626399",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-core-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784054598",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628235",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055387",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627106",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055726",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786629761",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667517",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627559",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-metrics-exporter-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667577",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786687918",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667611",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786629478",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cli-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055020",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628142",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cloudnative-pg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667641",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786631508",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055586",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628053",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cosi-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667790",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627382",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667859",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627430",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667875",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786629076",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-external-snapshotter-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667869",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627469",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-external-snapshotter-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667877",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786644072",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055576",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786688215",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055244",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628340",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-must-gather-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055382",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628623",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783668266",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786632256",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odr-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783668288",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628935",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/rook-ceph-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783669219",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786629548",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/code-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782498475",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/dashboard-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782498792",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:2.6::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-ossmc-rhel8",
            "product": "Red Hat OpenShift Service Mesh 2.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1781937133",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:2.6::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-rhel8",
            "product": "Red Hat OpenShift Service Mesh 2.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782287580",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-ossmc-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782201894",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782201833",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-ossmc-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782201696",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782201537",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-ossmc-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782201851",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782201812",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-ossmc-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782231869",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782201466",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhtas/rekor-search-ui-rhel9",
            "product": "Red Hat Trusted Artifact Signer 1.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783327185",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "cryostat-openshift-console-plugin-npm",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana-infinity-datasource-npm",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ws",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:gatekeeper:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "gatekeeper/gatekeeper-rhel9",
            "product": "Gatekeeper 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/node-healthcheck-must-gather-rhel9",
            "product": "Node HealthCheck Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/node-healthcheck-operator-bundle",
            "product": "Node HealthCheck Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/node-healthcheck-rhel9-operator",
            "product": "Node HealthCheck Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_lightspeed"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-lightspeed/lightspeed-console-plugin-419-rhel9",
            "product": "OpenShift Lightspeed",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_lightspeed"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9",
            "product": "OpenShift Lightspeed",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_lightspeed"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-lightspeed/lightspeed-console-plugin-rhel9",
            "product": "OpenShift Lightspeed",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-console-plugin-pf5-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-console-plugin-rhel8",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-console-plugin-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-hub-ui-rhel8",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-hub-ui-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-service-mesh/kiali-operator-bundle",
            "product": "OpenShift Service Mesh 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-service-mesh/kiali-rhel9-operator",
            "product": "OpenShift Service Mesh 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform-24/lightspeed-rhel8",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform-25/lightspeed-rhel8",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ansible-automation-platform-26/gateway-rhel9",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform-26/lightspeed-rhel9",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ansible-automation-platform-27/gateway-rhel9",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform-27/lightspeed-rhel9",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "affected",
            "packageName": "automation-controller",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "automation-eda-controller",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_spring_boot:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ws",
            "product": "Red Hat build of Apache Camel for Spring Boot 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_hawtio:4"
            ],
            "defaultStatus": "affected",
            "packageName": "ws",
            "product": "Red Hat build of Apache Camel - HawtIO 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ws",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:podman_desktop:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rh-podman-desktop.git",
            "product": "Red Hat Build of Podman Desktop",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:podman_desktop:0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdesktop/rh-podman-desktop-ext-bootc-rhel10",
            "product": "Red Hat Build of Podman Desktop - Tech Preview",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:podman_desktop:0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdesktop/rh-podman-desktop-ext-rhel-rhel10",
            "product": "Red Hat Build of Podman Desktop - Tech Preview",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:podman_desktop:0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdesktop/rh-podman-desktop-ext-sandbox-rhel10",
            "product": "Red Hat Build of Podman Desktop - Tech Preview",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:connectivity_link:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcl-1/rhcl-console-plugin-rhel9",
            "product": "Red Hat Connectivity Link 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ws",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet8.0",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet9.0",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "pcs",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rust",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet5.0-build-reference-packages",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet8.0",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet9.0",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana-pcp",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "mozjs60",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "pcs",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rust",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "ceph",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet8.0",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet9.0",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "gjs",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "pcs",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rust",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-gaudi-rhel9",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-rocm-rhel9",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/disk-image-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rust",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "thrift",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "affected",
            "packageName": "ws",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet10.0",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet8.0",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet9.0",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ruff",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rust",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "yarnpkg",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ws",
            "product": "Red Hat JBoss Enterprise Application Platform 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ws",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-mlflow-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-eval-hub-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-mod-arch-mlflow-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-agent-installer-ui-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/ose-console",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/ose-console-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/ose-monitoring-plugin-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-native-virtualization/kubevirt-console-plugin",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-native-virtualization/kubevirt-console-plugin-rhel9",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quay:3"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "affected",
            "packageName": "satellite/iop-vulnerability-frontend-rhel9",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_portal:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform/automation-portal",
            "product": "Self-service automation portal 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_portal:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform/bootc-automation-portal-rhel9",
            "product": "Self-service automation portal 2",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-16T21:26:22.537Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in ws, an open source WebSocket client and server. A remote attacker can exploit this memory exhaustion vulnerability by sending a high volume of exceptionally small fragments and data chunks. This action forces the affected component to allocate and hold structural wrappers that consume excessive memory. Consequently, this leads to process termination and a denial of service (DoS) for the remote peer."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1050",
                "description": "Excessive Platform Resource Consumption within a Loop",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T12:09:07.247Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-48779"
          },
          {
            "name": "RHBZ#2489661",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489661"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:48151"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34342"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57590"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66545"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66488"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36754"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33574"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29197"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41928"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65126"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60520"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36820"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33155"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33160"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33163"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33173"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33183"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56431"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41941"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41944"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56366"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57013"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40984"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37272"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:48151: Cryostat 4 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34342: Cluster Observability Operator 1.5.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57590: Red Hat Enterprise Linux Extensions Channel (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66545: Red Hat AMQ Broker 7.13.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66488: Red Hat AMQ Broker 7.14.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36754: Red Hat Developer Hub 1.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33574: Red Hat Developer Hub 1.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29197: Red Hat Discovery 2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41928: Red Hat Migration Toolkit 1.8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65126: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60520: Red Hat OpenShift AI 3.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33155: Red Hat OpenShift Service Mesh 2.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33160: Red Hat OpenShift Service Mesh 3.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33163: Red Hat OpenShift Service Mesh 3.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33173: Red Hat OpenShift Service Mesh 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33183: Red Hat OpenShift Service Mesh 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56431: Red Hat Openshift Data Foundation 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41941: Red Hat Openshift Data Foundation 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41944: Red Hat Openshift Data Foundation 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56366: Red Hat Openshift Data Foundation 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57013: Red Hat Openshift Data Foundation 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40984: Red Hat Openshift Data Foundation 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37272: Red Hat Trusted Artifact Signer 1.4"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-16T22:01:24.571Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-16T21:26:22.537Z",
            "value": "Made public."
          }
        ],
        "title": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ws",
          "vendor": "websockets",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.1.0, \u003c 5.2.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.2.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.5.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.21.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-16T21:26:22.537Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p"
        },
        {
          "name": "https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7"
        },
        {
          "name": "https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53"
        },
        {
          "name": "https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94"
        },
        {
          "name": "https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8"
        }
      ],
      "source": {
        "advisory": "GHSA-96hv-2xvq-fx4p",
        "discovery": "UNKNOWN"
      },
      "title": "ws: Memory exhaustion DoS from tiny fragments and data chunks"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48779",
    "datePublished": "2026-06-16T21:26:22.537Z",
    "dateReserved": "2026-05-22T20:18:20.365Z",
    "dateUpdated": "2026-09-11T12:09:07.247Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56854 (GCVE-0-2026-56854)

Vulnerability from cvelistv5 – Published: 2026-08-28 15:14 – Updated: 2026-08-28 20:17

Title

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

Summary

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 20:16 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

Go Google root

References

3 references

URL	Tags
https://go.dev/issue/80213
https://go.dev/cl/797040
https://pkg.go.dev/vuln/GO-2026-6303

Impacted products

1 product

Vendor	Product	Version
golang.org/x/crypto	golang.org/x/crypto/ssh	Affected: 0 , < 0.55.0 (semver)

Credits

Longwei Wang (@gn00295120)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56854",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T20:16:07.248758Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-863",
                "description": "CWE-863 Incorrect Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T20:17:17.397Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/crypto/ssh",
          "product": "golang.org/x/crypto/ssh",
          "programRoutines": [
            {
              "name": "connection.serverAuthenticate"
            },
            {
              "name": "NewServerConn"
            }
          ],
          "vendor": "golang.org/x/crypto",
          "versions": [
            {
              "lessThan": "0.55.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Longwei Wang (@gn00295120)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client\u0027s remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T15:14:26.918Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80213"
        },
        {
          "url": "https://go.dev/cl/797040"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6303"
        }
      ],
      "title": "Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56854",
    "datePublished": "2026-08-28T15:14:26.918Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-28T20:17:17.397Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59869 (GCVE-0-2026-59869)

Vulnerability from cvelistv5 – Published: 2026-07-08 15:15 – Updated: 2026-07-09 15:14

Title

js-yaml: YAML merge-key chains can force quadratic CPU consumption

Summary

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 15:14 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/nodeca/js-yaml/security/adviso…	x_refsource_CONFIRM
https://github.com/nodeca/js-yaml/commit/24f13e79…	x_refsource_MISC
https://github.com/nodeca/js-yaml/commit/59423c6f…	x_refsource_MISC
https://github.com/nodeca/js-yaml/releases/tag/3.15.0	x_refsource_MISC
https://github.com/nodeca/js-yaml/releases/tag/4.3.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nodeca	js-yaml	Affected: >= 3.0.0, < 3.15.0 Affected: >= 4.0.0, < 4.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59869",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T15:14:16.302841Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T15:14:29.753Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "js-yaml",
          "vendor": "nodeca",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.15.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T15:15:54.675Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"
        },
        {
          "name": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7"
        },
        {
          "name": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"
        },
        {
          "name": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0"
        },
        {
          "name": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0"
        }
      ],
      "source": {
        "advisory": "GHSA-52cp-r559-cp3m",
        "discovery": "UNKNOWN"
      },
      "title": "js-yaml: YAML merge-key chains can force quadratic CPU consumption"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59869",
    "datePublished": "2026-07-08T15:15:54.675Z",
    "dateReserved": "2026-07-07T15:41:53.607Z",
    "dateUpdated": "2026-07-09T15:14:29.753Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73086 (GCVE-0-2026-73086)

Vulnerability from cvelistv5 – Published: 2026-08-11 16:46 – Updated: 2026-08-12 14:29

Title

nanoid: Integer Overflow or Wraparound

Summary

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 14:26 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/ai/nanoid/security/advisories/…	x_refsource_CONFIRM
https://github.com/ai/nanoid/commit/7087969281cab…	x_refsource_MISC
https://github.com/ai/nanoid/commit/821dfed7b5db7…	x_refsource_MISC
https://github.com/ai/nanoid/commit/b0036ed60dc9f…	x_refsource_MISC
https://github.com/ai/nanoid/releases/tag/3.3.12	x_refsource_MISC
https://github.com/ai/nanoid/releases/tag/5.1.11	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
ai	nanoid	Affected: < 3.3.12 Affected: >= 4.0.0, < 5.1.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73086",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T14:26:22.656696Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T14:29:36.568Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nanoid",
          "vendor": "ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.3.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 5.1.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T16:46:23.024Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w"
        },
        {
          "name": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4"
        },
        {
          "name": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3"
        },
        {
          "name": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac"
        },
        {
          "name": "https://github.com/ai/nanoid/releases/tag/3.3.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ai/nanoid/releases/tag/3.3.12"
        },
        {
          "name": "https://github.com/ai/nanoid/releases/tag/5.1.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ai/nanoid/releases/tag/5.1.11"
        }
      ],
      "source": {
        "advisory": "GHSA-xwg4-73v4-xw9w",
        "discovery": "UNKNOWN"
      },
      "title": "nanoid: Integer Overflow or Wraparound"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73086",
    "datePublished": "2026-08-11T16:46:23.024Z",
    "dateReserved": "2026-08-10T19:37:41.445Z",
    "dateUpdated": "2026-08-12T14:29:36.568Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73088 (GCVE-0-2026-73088)

Vulnerability from cvelistv5 – Published: 2026-08-11 17:00 – Updated: 2026-08-13 14:50

Title

Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

Summary

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 14:50 UTC

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-248 - Uncaught Exception

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/browserslist/browserslist/secu…	x_refsource_CONFIRM
https://github.com/browserslist/browserslist/comm…	x_refsource_MISC
https://github.com/browserslist/browserslist/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
browserslist	browserslist	Affected: < 4.28.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73088",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T14:50:35.461987Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T14:50:43.387Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "browserslist",
          "vendor": "browserslist",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.28.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T17:00:05.869Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"
        },
        {
          "name": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51"
        },
        {
          "name": "https://github.com/browserslist/browserslist/releases/tag/4.28.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/browserslist/browserslist/releases/tag/4.28.7"
        }
      ],
      "source": {
        "advisory": "GHSA-73wf-gq98-2v4g",
        "discovery": "UNKNOWN"
      },
      "title": "Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73088",
    "datePublished": "2026-08-11T17:00:05.869Z",
    "dateReserved": "2026-08-10T19:37:41.445Z",
    "dateUpdated": "2026-08-13T14:50:43.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73089 (GCVE-0-2026-73089)

Vulnerability from cvelistv5 – Published: 2026-08-11 17:05 – Updated: 2026-08-13 14:07

Title

Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

Summary

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 13:14 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/browserslist/browserslist/secu…	x_refsource_CONFIRM
https://github.com/browserslist/browserslist/comm…	x_refsource_MISC
https://github.com/browserslist/browserslist/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
browserslist	browserslist	Affected: < 4.28.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73089",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T13:14:03.856150Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T14:07:57.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "browserslist",
          "vendor": "browserslist",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.28.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `\u003cyear\u003e-\u003cmonth\u003e-\u003cday\u003e` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T17:05:38.760Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"
        },
        {
          "name": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405"
        },
        {
          "name": "https://github.com/browserslist/browserslist/releases/tag/4.28.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/browserslist/browserslist/releases/tag/4.28.7"
        }
      ],
      "source": {
        "advisory": "GHSA-c83g-rgw3-j3cx",
        "discovery": "UNKNOWN"
      },
      "title": "Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73089",
    "datePublished": "2026-08-11T17:05:38.760Z",
    "dateReserved": "2026-08-10T19:37:41.445Z",
    "dateUpdated": "2026-08-13T14:07:57.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73500 (GCVE-0-2026-73500)

Vulnerability from cvelistv5 – Published: 2026-08-12 21:22 – Updated: 2026-08-13 17:53

Title

etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

Summary

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 17:49 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

9 references

URL	Tags
https://github.com/etcd-io/etcd/security/advisori…	x_refsource_CONFIRM
https://github.com/etcd-io/etcd/pull/22130	x_refsource_MISC
https://github.com/etcd-io/etcd/commit/2e07efce97…	x_refsource_MISC
https://github.com/etcd-io/etcd/commit/89ff6d5079…	x_refsource_MISC
https://github.com/etcd-io/etcd/commit/8e4dd0679a…	x_refsource_MISC
https://github.com/etcd-io/etcd/commit/f73cba7d92…	x_refsource_MISC
https://github.com/etcd-io/etcd/releases/tag/v3.5.33	x_refsource_MISC
https://github.com/etcd-io/etcd/releases/tag/v3.6.14	x_refsource_MISC
https://github.com/etcd-io/etcd/releases/tag/v3.7.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
etcd-io	etcd	Affected: < 3.5.33 Affected: >= 3.6.0, < 3.6.14 Affected: >= 3.7.0-alpha.0, < 3.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73500",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T17:49:14.567913Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T17:53:16.094Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "etcd",
          "vendor": "etcd-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.5.33"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.6.0, \u003c 3.6.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.7.0-alpha.0, \u003c 3.7.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T21:22:25.151Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3"
        },
        {
          "name": "https://github.com/etcd-io/etcd/pull/22130",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/pull/22130"
        },
        {
          "name": "https://github.com/etcd-io/etcd/commit/2e07efce9745004eb4773cffaada9b5cdf77cff2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/commit/2e07efce9745004eb4773cffaada9b5cdf77cff2"
        },
        {
          "name": "https://github.com/etcd-io/etcd/commit/89ff6d50796049d4f1136915ba21504b76e7e372",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/commit/89ff6d50796049d4f1136915ba21504b76e7e372"
        },
        {
          "name": "https://github.com/etcd-io/etcd/commit/8e4dd0679a2c6b095d2a32a749fda2521c7809a3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/commit/8e4dd0679a2c6b095d2a32a749fda2521c7809a3"
        },
        {
          "name": "https://github.com/etcd-io/etcd/commit/f73cba7d920019f91a1ea1f6697833e42731f057",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/commit/f73cba7d920019f91a1ea1f6697833e42731f057"
        },
        {
          "name": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33"
        },
        {
          "name": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14"
        },
        {
          "name": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1"
        }
      ],
      "source": {
        "advisory": "GHSA-6vch-q96h-7gc3",
        "discovery": "UNKNOWN"
      },
      "title": "etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73500",
    "datePublished": "2026-08-12T21:22:25.151Z",
    "dateReserved": "2026-08-12T19:00:33.736Z",
    "dateUpdated": "2026-08-13T17:53:16.094Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73646 (GCVE-0-2026-73646)

Vulnerability from cvelistv5 – Published: 2026-08-17 15:35 – Updated: 2026-08-17 16:36

Title

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

Summary

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-17 16:35 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/postcss/postcss/security/advis…	x_refsource_CONFIRM
https://github.com/postcss/postcss/commit/95663d3…	x_refsource_MISC
https://github.com/postcss/postcss/releases/tag/8.5.18	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
postcss	postcss	Affected: < 8.5.18

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73646",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T16:35:17.036116Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T16:36:37.422Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "postcss",
          "vendor": "postcss",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.5.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T15:35:13.518Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849"
        },
        {
          "name": "https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c"
        },
        {
          "name": "https://github.com/postcss/postcss/releases/tag/8.5.18",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/postcss/postcss/releases/tag/8.5.18"
        }
      ],
      "source": {
        "advisory": "GHSA-r28c-9q8g-f849",
        "discovery": "UNKNOWN"
      },
      "title": "PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73646",
    "datePublished": "2026-08-17T15:35:13.518Z",
    "dateReserved": "2026-08-13T14:04:09.604Z",
    "dateUpdated": "2026-08-17T16:36:37.422Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:70829

CVE-2026-41178 (GCVE-0-2026-41178)

CVE-2026-45736 (GCVE-0-2026-45736)

CVE-2026-48779 (GCVE-0-2026-48779)

CVE-2026-56854 (GCVE-0-2026-56854)

CVE-2026-59869 (GCVE-0-2026-59869)

CVE-2026-73086 (GCVE-0-2026-73086)

CVE-2026-73088 (GCVE-0-2026-73088)

CVE-2026-73089 (GCVE-0-2026-73089)

CVE-2026-73500 (GCVE-0-2026-73500)

CVE-2026-73646 (GCVE-0-2026-73646)

Tags

Sightings

Nomenclature

Related by attack behaviour