RHSA-2026:76134

Vulnerability from csaf_redhat - Published: 2026-10-05 18:48 - Updated: 2026-10-06 02:12
Summary
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 for OpenShift image security update
Severity
Important
Notes
Topic: A new image is available for Red Hat Single Sign-On 7.6.13, running on OpenShift Container Platform 3.10 and 3.11, and 4.3.
Details: Red Hat Single Sign-On is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat Single Sign-On for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services. This erratum releases a new image for Red Hat Single Sign-On 7.6.13 for use within the OpenShift Container Platform 3.10, OpenShift Container Platform 3.11, and within the OpenShift Container Platform 4.3 cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release. This security update has moderate impact. Security fixes: * undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784) * Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF (CVE-2025-12543) * Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF (CVE-2025-12543) * Information disclosure and data deletion via second-order SQL injection (CVE-2026-0603) * GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813) * PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588) * unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505) * High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579) * HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581) * HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578) * Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) * Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) * IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249) * Denial of Service via malformed HAProxy message (CVE-2026-44893) * Denial of Service due to resource leak (CVE-2026-48043) * Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059) * Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691) * Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010) * Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674) * Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416) * Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) * Denial of Service via deeply nested JSON processing (CVE-2026-50193) * Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494) * Missing authentication on EAP's IIOP NameService leads to MITM or DoS (CVE-2026-15563) * Session fixation in OIDC login flow that can lead to account takeover (CVE-2026-7507) * Denial of Service via specially crafted SAML input (CVE-2026-7307) * Denial of Service due to excessive SAMLRequest decompression (CVE-2026-2575) * Denial of Service via excessive processing of OpenID Connect scope parameters (CVE-2026-4634) * Unauthorized access via improper validation of encrypted SAML assertions (CVE-2026-2092)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-9784

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Unresolved product id: 8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: 8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: 8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2025-12543

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

9.6 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
CWE-20 - Improper Input Validation
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2025-14813

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-0603

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.

8.3 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-2092

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

7.7 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
CWE-1287 - Improper Validation of Specified Type of Input
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-2575

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Moderate
CVE-2026-3505

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-4634

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-5588

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-347 - Improper Verification of Cryptographic Signature
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-7307

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1286 - Improper Validation of Syntactic Correctness of Input
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-7507

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection or cookie ownership validation—an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-290 - Authentication Bypass by Spoofing
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-15563

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-306 - Missing Authentication for Critical Function
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-42578

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-42579

A flaw was found in Netty. Netty's DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-1286 - Improper Validation of Syntactic Correctness of Input
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-42581

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.

7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-42587

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-44249

A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo() function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended network restrictions, potentially leading to unauthorized access or exposure of services.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-1287 - Improper Validation of Specified Type of Input
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-44893

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2_TYPE_SSL TLV (Type-Length-Value) header. This can lead to an IndexOutOfBoundsException and prevent the release of retained memory, ultimately causing a Denial of Service (DoS) condition for the affected application.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-805 - Buffer Access with Incorrect Length Value
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-45416

A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-45674

A flaw was found in Netty's DnsResolveContext. This vulnerability allows a remote attacker to achieve information disclosure or data manipulation by crafting malicious DNS responses. The flaw occurs because the DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses, which could enable an attacker to redirect network traffic or intercept sensitive data from affected applications.

8.7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE-346 - Origin Validation Error
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-47691

A flaw was found in Netty's `DnsResolveContext`. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing standard bailiwick rules. Consequently, future DNS resolutions for the affected parent domain will use the poisoned cache, potentially redirecting users to malicious servers and leading to information disclosure or integrity compromise.

8.7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE-346 - Origin Validation Error
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-48043

A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the `DelegatingDecompressorFrameListener` class. This resource leak could lead to an Out Of Memory Error (OOME), potentially causing a Denial of Service (DoS) by taking down the entire Java Virtual Machine (JVM).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-48059

A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested `PP2_TYPE_SSL` type-length-value (TLV) records. This can lead to a memory leak, causing the underlying cumulation buffer to remain permanently pinned and potentially resulting in a Denial of Service (DoS) due to resource exhaustion.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1286 - Improper Validation of Syntactic Correctness of Input
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-50010

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager (X509TrustManager), it fails to perform necessary hostname checks, enabling an attacker to impersonate a legitimate server. This could lead to sensitive information disclosure or man-in-the-middle attacks.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-347 - Improper Verification of Cryptographic Signature
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-50193

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-54512

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 - Deserialization of Untrusted Data
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
CVE-2026-68494

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 3 products, the same list as for CVE-2025-9784
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:76134 self
https://access.redhat.com/security/updates/classi… external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2025-9784 self
https://bugzilla.redhat.com/show_bug.cgi?id=2392306 external
https://www.cve.org/CVERecord?id=CVE-2025-9784 external
https://nvd.nist.gov/vuln/detail/CVE-2025-9784 external
https://github.com/undertow-io/undertow/pull/1778 external
https://github.com/undertow-io/undertow/releases/… external
https://issues.redhat.com/browse/UNDERTOW-2598 external
https://kb.cert.org/vuls/id/767506 external
https://access.redhat.com/security/cve/CVE-2025-12543 self
https://bugzilla.redhat.com/show_bug.cgi?id=2408784 external
https://www.cve.org/CVERecord?id=CVE-2025-12543 external
https://nvd.nist.gov/vuln/detail/CVE-2025-12543 external
https://access.redhat.com/security/cve/CVE-2025-14813 self
https://bugzilla.redhat.com/show_bug.cgi?id=2458640 external
https://www.cve.org/CVERecord?id=CVE-2025-14813 external
https://nvd.nist.gov/vuln/detail/CVE-2025-14813 external
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9… external
https://access.redhat.com/security/cve/CVE-2026-0603 self
https://bugzilla.redhat.com/show_bug.cgi?id=2427147 external
https://www.cve.org/CVERecord?id=CVE-2026-0603 external
https://nvd.nist.gov/vuln/detail/CVE-2026-0603 external
https://access.redhat.com/security/cve/CVE-2026-2092 self
https://bugzilla.redhat.com/show_bug.cgi?id=2437296 external
https://www.cve.org/CVERecord?id=CVE-2026-2092 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2092 external
https://access.redhat.com/security/cve/CVE-2026-2575 self
https://bugzilla.redhat.com/show_bug.cgi?id=2440149 external
https://www.cve.org/CVERecord?id=CVE-2026-2575 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2575 external
https://access.redhat.com/security/cve/CVE-2026-3505 self
https://bugzilla.redhat.com/show_bug.cgi?id=2458638 external
https://www.cve.org/CVERecord?id=CVE-2026-3505 external
https://nvd.nist.gov/vuln/detail/CVE-2026-3505 external
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9… external
https://access.redhat.com/security/cve/CVE-2026-4634 self
https://bugzilla.redhat.com/show_bug.cgi?id=2450250 external
https://www.cve.org/CVERecord?id=CVE-2026-4634 external
https://nvd.nist.gov/vuln/detail/CVE-2026-4634 external
https://access.redhat.com/security/cve/CVE-2026-5588 self
https://bugzilla.redhat.com/show_bug.cgi?id=2458634 external
https://www.cve.org/CVERecord?id=CVE-2026-5588 external
https://nvd.nist.gov/vuln/detail/CVE-2026-5588 external
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9… external
https://access.redhat.com/security/cve/CVE-2026-7307 self
https://bugzilla.redhat.com/show_bug.cgi?id=2476526 external
https://www.cve.org/CVERecord?id=CVE-2026-7307 external
https://nvd.nist.gov/vuln/detail/CVE-2026-7307 external
https://access.redhat.com/security/cve/CVE-2026-7507 self
https://bugzilla.redhat.com/show_bug.cgi?id=2464145 external
https://www.cve.org/CVERecord?id=CVE-2026-7507 external
https://nvd.nist.gov/vuln/detail/CVE-2026-7507 external
https://access.redhat.com/security/cve/CVE-2026-15563 self
https://bugzilla.redhat.com/show_bug.cgi?id=2483138 external
https://www.cve.org/CVERecord?id=CVE-2026-15563 external
https://nvd.nist.gov/vuln/detail/CVE-2026-15563 external
https://access.redhat.com/security/cve/CVE-2026-42578 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477226 external
https://www.cve.org/CVERecord?id=CVE-2026-42578 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42578 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-42579 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477217 external
https://www.cve.org/CVERecord?id=CVE-2026-42579 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42579 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-42581 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477232 external
https://www.cve.org/CVERecord?id=CVE-2026-42581 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42581 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-42587 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477220 external
https://www.cve.org/CVERecord?id=CVE-2026-42587 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42587 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-44249 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488081 external
https://www.cve.org/CVERecord?id=CVE-2026-44249 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44249 external
https://github.com/netty/netty/releases/tag/netty… external
https://github.com/netty/netty/releases/tag/netty… external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-44893 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488383 external
https://www.cve.org/CVERecord?id=CVE-2026-44893 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44893 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-45416 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488391 external
https://www.cve.org/CVERecord?id=CVE-2026-45416 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45416 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-45674 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488400 external
https://www.cve.org/CVERecord?id=CVE-2026-45674 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45674 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-47691 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488439 external
https://www.cve.org/CVERecord?id=CVE-2026-47691 external
https://nvd.nist.gov/vuln/detail/CVE-2026-47691 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-48043 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488442 external
https://www.cve.org/CVERecord?id=CVE-2026-48043 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48043 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-48059 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488437 external
https://www.cve.org/CVERecord?id=CVE-2026-48059 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48059 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-50010 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488429 external
https://www.cve.org/CVERecord?id=CVE-2026-50010 external
https://nvd.nist.gov/vuln/detail/CVE-2026-50010 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-50193 self
https://bugzilla.redhat.com/show_bug.cgi?id=2491999 external
https://www.cve.org/CVERecord?id=CVE-2026-50193 external
https://nvd.nist.gov/vuln/detail/CVE-2026-50193 external
https://github.com/FasterXML/jackson-databind/com… external
https://github.com/FasterXML/jackson-databind/iss… external
https://github.com/FasterXML/jackson-databind/sec… external
https://access.redhat.com/security/cve/CVE-2026-54512 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492015 external
https://www.cve.org/CVERecord?id=CVE-2026-54512 external
https://nvd.nist.gov/vuln/detail/CVE-2026-54512 external
https://github.com/FasterXML/jackson-databind/com… external
https://github.com/FasterXML/jackson-databind/iss… external
https://github.com/FasterXML/jackson-databind/sec… external
https://access.redhat.com/security/cve/CVE-2026-68494 self
https://bugzilla.redhat.com/show_bug.cgi?id=2511026 external
https://www.cve.org/CVERecord?id=CVE-2026-68494 external
https://nvd.nist.gov/vuln/detail/CVE-2026-68494 external
https://github.com/FasterXML/jackson-core/commit/… external
https://github.com/FasterXML/jackson-core/commit/… external
https://github.com/FasterXML/jackson-core/commit/… external
https://github.com/FasterXML/jackson-core/pull/1611 external
https://github.com/FasterXML/jackson-core/securit… external
https://github.com/advisories/GHSA-72hv-8253-57qq external
https://www.cve.org/CVERecord?id=CVE-2026-18401 external
Acknowledgments
Ahmet Artuç
YouGina Christiaan Swiers
HeroDevs Tommy Williams
Oleh Konko
GMO Cybersecurity by Ierae, Inc. Sho Odagiri
Independent Security Researcher Evan Hendra
Anchels
Calif.io Hacking Team
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new image is available for Red Hat Single Sign-On 7.6.13, running on OpenShift\nContainer Platform 3.10 and 3.11, and 4.3.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Single Sign-On is an integrated sign-on solution, available as a\nRed Hat JBoss Middleware for OpenShift containerized image. The Red Hat\nSingle Sign-On for OpenShift image provides an authentication server that\nyou can use to log in centrally, log out, and register. You can also manage\nuser accounts for web applications, mobile applications, and RESTful web\nservices.\n\nThis erratum releases a new image for Red Hat Single Sign-On 7.6.13 for\nuse within the OpenShift Container Platform 3.10, OpenShift Container Platform\n3.11, and within the OpenShift Container Platform 4.3 cloud computing\nPlatform-as-a-Service (PaaS) for on-premise or private cloud deployments,\naligning with the standalone product release. This security update has moderate\nimpact.\n\nSecurity fixes:\n* undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784)\n* Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF (CVE-2025-12543)\n* Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF (CVE-2025-12543)\n* Information disclosure and data deletion via second-order SQL injection (CVE-2026-0603)\n* GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)\n* PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)\n* unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)\n* High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579)\n* HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581)\n* HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578)\n* Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)\n* Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)\n* IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)\n* Denial of Service via malformed HAProxy message (CVE-2026-44893)\n* Denial of Service due to resource leak (CVE-2026-48043)\n* Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059)\n* Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)\n* Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010)\n* Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)\n* Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)\n* Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)\n* Denial of Service via deeply nested JSON processing (CVE-2026-50193)\n* Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)\n* Missing authentication on EAP\u0027s IIOP NameService leads to MITM or DoS (CVE-2026-15563)\n* Session fixation in OIDC login flow that can lead to account takeover (CVE-2026-7507)\n* Denial of Service via specially crafted SAML input (CVE-2026-7307)\n* Denial of Service due to excessive SAMLRequest decompression (CVE-2026-2575)\n* Denial of Service via excessive processing of OpenID Connect scope parameters (CVE-2026-4634)\n* Unauthorized access via improper validation of encrypted SAML assertions (CVE-2026-2092)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:76134",
        "url": "https://access.redhat.com/errata/RHSA-2026:76134"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76134.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 for OpenShift image security update",
    "tracking": {
      "current_release_date": "2026-10-06T02:12:56+00:00",
      "generator": {
        "date": "2026-10-06T02:12:56+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:76134",
      "initial_release_date": "2026-10-05T18:48:54+00:00",
      "revision_history": [
        {
          "date": "2026-10-05T18:48:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-05T18:48:54+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-06T02:12:56+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Middleware Containers for OpenShift",
                "product": {
                  "name": "Middleware Containers for OpenShift",
                  "product_id": "8Base-RHOSE-Middleware",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhosemc:1.0::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
                "product": {
                  "name": "rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
                  "product_id": "rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac?arch=ppc64le\u0026repository_url=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8\u0026tag=7.6-85"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
                "product": {
                  "name": "rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
                  "product_id": "rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993?arch=amd64\u0026repository_url=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8\u0026tag=7.6-85"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x",
                "product": {
                  "name": "rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x",
                  "product_id": "rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc?arch=s390x\u0026repository_url=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8\u0026tag=7.6-85"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le"
        },
        "product_reference": "rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64"
        },
        "product_reference": "rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        },
        "product_reference": "rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-9784",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-09-01T06:19:20.938000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2392306"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undertow: Undertow MadeYouReset HTTP/2 DDoS Vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation, which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-9784"
        },
        {
          "category": "external",
          "summary": "RHBZ#2392306",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392306"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-9784",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-9784"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9784",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9784"
        },
        {
          "category": "external",
          "summary": "https://github.com/undertow-io/undertow/pull/1778",
          "url": "https://github.com/undertow-io/undertow/pull/1778"
        },
        {
          "category": "external",
          "summary": "https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final",
          "url": "https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final"
        },
        {
          "category": "external",
          "summary": "https://issues.redhat.com/browse/UNDERTOW-2598",
          "url": "https://issues.redhat.com/browse/UNDERTOW-2598"
        },
        {
          "category": "external",
          "summary": "https://kb.cert.org/vuls/id/767506",
          "url": "https://kb.cert.org/vuls/id/767506"
        }
      ],
      "release_date": "2025-09-01T06:21:54.614000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undertow: Undertow MadeYouReset HTTP/2 DDoS Vulnerability"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Ahmet Artu\u00e7"
          ]
        }
      ],
      "cve": "CVE-2025-12543",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2025-10-31T06:15:35.424000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2408784"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability has an Important severity because it can be remotely exploited without authentication. However, limited user interaction is required for full impact. It could allow attackers to hijack additional accounts, steal credentials, or gain access to internal systems. The issue stems from improper input validation of HTTP Host headers, leading to serious breaches in confidentiality and integrity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-12543"
        },
        {
          "category": "external",
          "summary": "RHBZ#2408784",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408784"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-12543",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-12543"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-12543",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12543"
        }
      ],
      "release_date": "2026-01-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use, applicability, or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF"
    },
    {
      "cve": "CVE-2025-14813",
      "cwe": {
        "id": "CWE-327",
        "name": "Use of a Broken or Risky Cryptographic Algorithm"
      },
      "discovery_date": "2026-04-15T10:01:27.769752+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2458640"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14813"
        },
        {
          "category": "external",
          "summary": "RHBZ#2458640",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
        }
      ],
      "release_date": "2026-04-15T08:56:34.057000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Christiaan Swiers"
          ],
          "organization": "YouGina"
        },
        {
          "names": [
            "Tommy Williams"
          ],
          "organization": "HeroDevs"
        }
      ],
      "cve": "CVE-2026-0603",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "discovery_date": "2026-01-05T13:12:29.816000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2427147"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application\u0027s database, resulting in an application level denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.hibernate/hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injection",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important for Red Hat products as it allows a remote attacker with low privileges to perform second-order SQL injection in applications using Hibernate\u0027s InlineIdsOrClauseBuilder with unsanitized non-alphanumeric characters in the ID column. This could lead to sensitive information disclosure and data manipulation or deletion.Affected Hibernate ORM versions are 5.2.8 through 5.6.15 (inclusive); earlier versions are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-0603"
        },
        {
          "category": "external",
          "summary": "RHBZ#2427147",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427147"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-0603",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0603"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0603",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0603"
        }
      ],
      "release_date": "2026-01-19T10:10:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.hibernate/hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injection"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Oleh Konko"
          ]
        }
      ],
      "cve": "CVE-2026-2092",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-02-06T10:25:16.675000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2437296"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Keycloak. Keycloak\u0027s Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The issue is rated as important severity. A flaw in Red Hat Build of Keycloak\u0027s SAML broker endpoint allows unauthorized access. When the overall SAML response is not signed, an attacker with a valid signed SAML assertion can craft a malicious response to inject an encrypted assertion for an arbitrary principal. This leads to unauthorized access and potential information disclosure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2092"
        },
        {
          "category": "external",
          "summary": "RHBZ#2437296",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437296"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2092",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2092"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2092",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2092"
        }
      ],
      "release_date": "2026-03-05T12:34:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Sho Odagiri"
          ],
          "organization": "GMO Cybersecurity by Ierae, Inc."
        }
      ],
      "cve": "CVE-2026-2575",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-02-16T08:36:10.890000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2440149"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak: Keycloak: Denial of Service due to excessive SAMLRequest decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This MODERATE impact denial of service flaw affects Red Hat Build of Keycloak (RHBK). An unauthenticated remote attacker can exploit this by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server\u0027s inability to enforce size limits during DEFLATE decompression leads to an OutOfMemoryError, causing process termination and disrupting service availability. This vulnerability is applicable when Keycloak is configured to use SAML Redirect Binding.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2575"
        },
        {
          "category": "external",
          "summary": "RHBZ#2440149",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440149"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2575",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2575"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2575",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2575"
        }
      ],
      "release_date": "2026-02-16T08:08:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak: Keycloak: Denial of Service due to excessive SAMLRequest decompression"
    },
    {
      "cve": "CVE-2026-3505",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-15T10:01:17.415497+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2458638"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3505"
        },
        {
          "category": "external",
          "summary": "RHBZ#2458638",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
        }
      ],
      "release_date": "2026-04-15T09:06:37.939000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Evan Hendra"
          ],
          "organization": "Independent Security Researcher"
        }
      ],
      "cve": "CVE-2026-4634",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-03-23T08:40:02.817000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2450250"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak: Keycloak: Denial of Service via excessive processing of OpenID Connect scope parameters",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Red Hat Build of Keycloak (RHBK). An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect token endpoint, leading to high resource consumption and prolonged processing times on the Keycloak server.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4634"
        },
        {
          "category": "external",
          "summary": "RHBZ#2450250",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450250"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4634",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4634"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4634",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4634"
        }
      ],
      "release_date": "2026-04-02T12:30:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak: Keycloak: Denial of Service via excessive processing of OpenID Connect scope parameters"
    },
    {
      "cve": "CVE-2026-5588",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-04-15T10:00:59.672015+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2458634"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5588"
        },
        {
          "category": "external",
          "summary": "RHBZ#2458634",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
        }
      ],
      "release_date": "2026-04-15T09:06:15.617000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Anchels"
          ]
        }
      ],
      "cve": "CVE-2026-7307",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-05-12T16:20:11.587000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476526"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak: Keycloak: Denial of Service via specially crafted SAML input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a High severity denial of service vulnerability in Keycloak. An unauthenticated attacker with network access can send specially crafted XML input to the SAML endpoint, causing high CPU utilization and worker thread exhaustion, which renders the Keycloak server unavailable. This directly impacts the availability of Keycloak instances where the SAML protocol is enabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-7307"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476526",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476526"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-7307",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-7307"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-7307",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7307"
        }
      ],
      "release_date": "2026-05-19T10:42:34.560000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, restrict network access to the Keycloak SAML endpoint to trusted networks and clients. Implement firewall rules to limit inbound connections to the Keycloak service port (e.g., 8080) from untrusted sources. If the SAML protocol is not required for your deployment, consider disabling it to eliminate the attack surface. Applying these network restrictions or configuration changes may necessitate a restart or reload of the Keycloak service, which could temporarily affect its availability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak: Keycloak: Denial of Service via specially crafted SAML input"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Hacking Team"
          ],
          "organization": "Calif.io"
        }
      ],
      "cve": "CVE-2026-7507",
      "cwe": {
        "id": "CWE-290",
        "name": "Authentication Bypass by Spoofing"
      },
      "discovery_date": "2026-04-30T14:57:56.441000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2464145"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A session fixation vulnerability was found in Keycloak\u0027s login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint\u2014which processes session handles without adequate CSRF protection or cookie ownership validation\u2014an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim\u0027s credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.keycloak/keycloak-services: Session fixation in OIDC login flow that can lead to account takeover",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a Critical session fixation vulnerability in Keycloak\u0027s login-actions endpoints. An unauthenticated attacker can pre-create an authentication session and, by exploiting a lack of CSRF token or cookie ownership checks on the `/login-actions/restart` endpoint, reset the flow state to achieve silent Single Sign-On (SSO). This allows for full takeover of the master-realm admin account in default Keycloak deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-7507"
        },
        {
          "category": "external",
          "summary": "RHBZ#2464145",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464145"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-7507",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-7507"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-7507",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7507"
        }
      ],
      "release_date": "2026-05-19T10:51:31.418000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.keycloak/keycloak-services: Session fixation in OIDC login flow that can lead to account takeover"
    },
    {
      "cve": "CVE-2026-15563",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "discovery_date": "2026-05-29T01:18:12.701000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2483138"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in EAP\u0027s IIOP. The listener\u0027s NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wildfly-iiop-openjdk: Missing authentication on EAP\u0027s IIOP NameService leads to MITM or DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15563"
        },
        {
          "category": "external",
          "summary": "RHBZ#2483138",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483138"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15563",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15563"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15563",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15563"
        }
      ],
      "release_date": "2026-08-11T05:54:01.358000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "wildfly-iiop-openjdk: Missing authentication on EAP\u0027s IIOP NameService leads to MITM or DoS"
    },
    {
      "cve": "CVE-2026-42578",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2026-05-13T19:02:00.826936+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477226"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This vulnerability in Netty\u0027s HttpProxyHandler allows for HTTP header injection into CONNECT requests when an attacker can influence outbound headers. The handler\u0027s explicit disabling of header validation could enable proxy-related attacks, such as cache poisoning or bypassing security controls, impacting applications utilizing this component.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42578"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477226",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42578",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42578"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr"
        }
      ],
      "release_date": "2026-05-13T17:57:43.538000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Applications utilizing Netty\u0027s HttpProxyHandler must ensure that any user-controlled input used to populate outbound headers is rigorously sanitized to prevent CRLF injection. If comprehensive input sanitization cannot be implemented, restricting network access to the application that uses the HttpProxyHandler can reduce the attack surface.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation"
    },
    {
      "cve": "CVE-2026-42579",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-05-13T19:01:25.062732+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477217"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. Netty\u0027s DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important integrity flaw in Netty\u0027s DNS codec. The vulnerability arises from insufficient enforcement of RFC 1035 domain name constraints during both encoding and decoding, allowing remote attackers to manipulate DNS responses or user-controlled hostnames. This could lead to a high integrity impact on affected Red Hat products that utilize the vulnerable Netty DNS codec.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42579"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477217",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477217"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42579",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42579"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm"
        }
      ],
      "release_date": "2026-05-13T18:01:52.500000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement"
    },
    {
      "cve": "CVE-2026-42581",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-05-13T19:02:26.404511+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477232"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw. Netty\u0027s HttpObjectDecoder, used across various Red Hat products, improperly handles conflicting `Transfer-Encoding: chunked` and `Content-Length` headers in HTTP/1.0 requests. This allows a remote attacker to perform HTTP request smuggling, potentially bypassing security controls or gaining unauthorized access to information due to misinterpretation of message boundaries by downstream proxies or handlers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42581"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477232",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42581",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42581"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"
        }
      ],
      "release_date": "2026-05-13T17:54:44.492000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, configure any reverse proxies or load balancers in front of Netty to either reject HTTP/1.0 requests containing both Transfer-Encoding: chunked and Content-Length headers, or to explicitly prioritize the Transfer-Encoding header over Content-Length for HTTP/1.0 traffic. This ensures consistent interpretation of message boundaries and prevents request smuggling attacks.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers"
    },
    {
      "cve": "CVE-2026-42587",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-13T19:01:35.415881+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477220"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Netty\u0027s HTTP content decompression. A remote attacker can exploit this flaw by sending specially crafted compressed payloads using Brotli, Zstandard, or Snappy encodings, bypassing configured decompression limits. This leads to unbounded memory allocation, potentially causing an out-of-memory condition and rendering affected Red Hat systems unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42587"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477220",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42587",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42587"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
        }
      ],
      "release_date": "2026-05-13T18:22:21.699000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression"
    },
    {
      "cve": "CVE-2026-44249",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-06-11T22:02:05.327173+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488081"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo() function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended network restrictions, potentially leading to unauthorized access or exposure of services.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in netty-handler is rated as Important because a remote attacker can bypass configured IPv6 subnet filtering rules. This flaw, stemming from an incorrect masking operation, could allow unauthorized access to or exposure of services that are intended to be network-restricted within Red Hat products utilizing the affected Netty component.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44249"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488081",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44249",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44249"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86"
        }
      ],
      "release_date": "2026-06-11T20:46:14.110000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation"
    },
    {
      "cve": "CVE-2026-44893",
      "cwe": {
        "id": "CWE-805",
        "name": "Buffer Access with Incorrect Length Value"
      },
      "discovery_date": "2026-06-12T15:01:18.066312+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488383"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2_TYPE_SSL TLV (Type-Length-Value) header. This can lead to an IndexOutOfBoundsException and prevent the release of retained memory, ultimately causing a Denial of Service (DoS) condition for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated as Important because a remote, unauthenticated attacker can trigger a denial of service in applications utilizing `netty-codec-haproxy`. By sending a specially crafted HAProxy message with a malformed SSL TLV header, an attacker can cause an `IndexOutOfBoundsException`, leading to unreleased memory and resource exhaustion. This can render the affected application unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44893"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488383",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488383"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44893",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44893"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44893",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44893"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv"
        }
      ],
      "release_date": "2026-06-12T14:00:25.801000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message"
    },
    {
      "cve": "CVE-2026-45416",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-12T15:01:45.671884+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488391"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in Netty is rated as Important. It allows a remote attacker to trigger a denial of service by sending a specially crafted TLS ClientHello message. The flaw arises from an eager, unbounded memory allocation during the TLS handshake, particularly when default configurations disable the maximum client hello length guard, leading to excessive resource consumption in affected Red Hat products utilizing Netty.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45416"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488391",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45416",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45416"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh"
        }
      ],
      "release_date": "2026-06-12T14:10:05.585000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, configure applications utilizing Netty\u0027s `SslClientHelloHandler` to specify a non-zero value for the `maxClientHelloLength` parameter. This will enable the internal length validation, preventing the eager allocation of large memory buffers when processing crafted TLS ClientHello messages. Refer to your specific application\u0027s documentation for details on configuring Netty\u0027s TLS handler. A restart of the affected application or service is required for the configuration changes to take effect.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake"
    },
    {
      "cve": "CVE-2026-45674",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-06-12T15:02:15.565158+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488400"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s DnsResolveContext. This vulnerability allows a remote attacker to achieve information disclosure or data manipulation by crafting malicious DNS responses. The flaw occurs because the DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses, which could enable an attacker to redirect network traffic or intercept sensitive data from affected applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important severity flaw in Netty\u0027s DnsResolveContext allows a remote attacker to achieve information disclosure or data manipulation. By crafting malicious DNS responses, an attacker could redirect network traffic or intercept sensitive data, impacting applications utilizing Netty for DNS resolution in Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45674"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488400",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488400"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45674",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45674"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45674",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45674"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc"
        }
      ],
      "release_date": "2026-06-12T14:17:50.203000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation"
    },
    {
      "cve": "CVE-2026-47691",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-06-12T16:02:45.855856+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488439"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s `DnsResolveContext`. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing standard bailiwick rules. Consequently, future DNS resolutions for the affected parent domain will use the poisoned cache, potentially redirecting users to malicious servers and leading to information disclosure or integrity compromise.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Netty\u0027s DNS resolution component, `netty-resolver-dns`, allows for DNS cache poisoning. An attacker with control over an authoritative name server for a subdomain could exploit this vulnerability to inject malicious DNS records into the cache of parent domains. This could lead to redirection of network traffic, impacting the integrity and availability of services relying on DNS resolution within affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-47691"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488439",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488439"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-47691",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-47691"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47691",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47691"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85"
        }
      ],
      "release_date": "2026-06-12T14:33:16.595000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records"
    },
    {
      "cve": "CVE-2026-48043",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-06-12T16:02:56.371830+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488442"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the `DelegatingDecompressorFrameListener` class. This resource leak could lead to an Out Of Memory Error (OOME), potentially causing a Denial of Service (DoS) by taking down the entire Java Virtual Machine (JVM).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in netty-codec-http2, affecting Red Hat products that utilize HTTP/2 communication with decompression. A remote attacker can exploit a resource leak in the `DelegatingDecompressorFrameListener` by sending malformed HTTP/2 frames, potentially leading to an Out Of Memory Error and causing the Java Virtual Machine to terminate. This could disrupt service availability in affected deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48043"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488442",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488442"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48043",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48043"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48043",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48043"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j"
        }
      ],
      "release_date": "2026-06-12T14:39:52.498000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak"
    },
    {
      "cve": "CVE-2026-48059",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-06-12T16:02:40.032749+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488437"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested `PP2_TYPE_SSL` type-length-value (TLV) records. This can lead to a memory leak, causing the underlying cumulation buffer to remain permanently pinned and potentially resulting in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in the Netty HAProxy PROXY protocol v2 codec, which can lead to a denial of service. A remote attacker can trigger a memory leak by sending a specially crafted HAProxy PROXY protocol v2 header with deeply nested SSL TLV records, causing resource exhaustion in affected Red Hat products that utilize this codec.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48059"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488437",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488437"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48059",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48059"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48059",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48059"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j"
        }
      ],
      "release_date": "2026-06-12T14:42:44.677000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers"
    },
    {
      "cve": "CVE-2026-50010",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-06-12T16:02:13.735675+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488429"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager (X509TrustManager), it fails to perform necessary hostname checks, enabling an attacker to impersonate a legitimate server. This could lead to sensitive information disclosure or man-in-the-middle attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in Netty that affects Red Hat products utilizing the `netty-handler` component, including various Red Hat AMQ, Enterprise Application Platform, and OpenShift offerings. The vulnerability arises when a Netty client is configured with a plain X.509 Trust Manager, leading to a bypass of hostname verification. This oversight allows a remote attacker to perform man-in-the-middle attacks by impersonating a legitimate server, potentially compromising sensitive data.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50010"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488429",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488429"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50010",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50010"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9"
        }
      ],
      "release_date": "2026-06-12T14:50:43.151000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass"
    },
    {
      "cve": "CVE-2026-50193",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-06-23T22:01:01.154533+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491999"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50193"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491999",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
          "url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
          "url": "https://github.com/FasterXML/jackson-databind/issues/3447"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
        }
      ],
      "release_date": "2026-06-23T21:00:20.444000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
    },
    {
      "cve": "CVE-2026-54512",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2026-06-23T22:01:49.821346+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492015"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54512"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492015",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
          "url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
          "url": "https://github.com/FasterXML/jackson-databind/issues/5988"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
        }
      ],
      "release_date": "2026-06-23T20:56:36.646000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
    },
    {
      "cve": "CVE-2026-68494",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-04T15:01:53.631865+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511026"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68494"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511026",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
          "url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
          "url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
          "url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/pull/1611",
          "url": "https://github.com/FasterXML/jackson-core/pull/1611"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
          "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
          "url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
        }
      ],
      "release_date": "2026-08-04T14:39:14.471000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T18:48:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76134"
        },
        {
          "category": "workaround",
          "details": "Upgrade com.fasterxml.jackson.core:jackson-core to a fixed version, such as 2.18.8 or later, 2.21.4 or later, or the first fixed release in the applicable 2.22.x stream. For Jackson 3.x, upgrade to 3.1.4 or later, or the first fixed release in the applicable 3.2.x stream. If upgrading is not immediately possible, do not expose the non-blocking parser to untrusted, incrementally streamed JSON. Where feasible, use a synchronous parser or buffer and enforce strict request-size, connection-timeout, and concurrency limits at the ingress layer. Apply the upgrade as soon as possible because ingress limits reduce exposure but do not correct the parser defect.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:3c851f2398ba67beb5b9ca55d984010262b35bf9d659f279829abd33da01a7ac_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c5afebef31c670ec67dab77ebaef767778c89c88be00f108cc435773fc42a993_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:d466be5920b7e34edbca61e8e565dce1e8139b22481fa1d1b8f98d79acc946dc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.