RHSA-2026:77532

Vulnerability from csaf_redhat - Published: 2026-10-07 09:44 - Updated: 2026-10-12 22:57
Summary
Red Hat Security Advisory: Release of components for Service Telemetry Framework 1.5.7
Severity
Important
Notes
Topic: Release of components for the Service Telemetry Framework
Details: Service Telemetry Framework (STF) provides automated collection of measurements and data from remote clients, such as Red Hat OpenStack Platform or third-party nodes. STF then transmits the information to a centralized, receiving Red Hat OpenShift Container Platform deployment for storage, retrieval, and monitoring. Security Fixes: * golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59885) * pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-32281

A flaw was found in Go's `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64 —
Workaround
Unresolved product id: Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64 —
Workaround
Unresolved product id: Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64 —
Workaround
Unresolved product id: Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64 —
Workaround
Unresolved product id: Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64 —
Workaround
Unresolved product id: Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64 —
Workaround
Threats
Impact Moderate
CVE-2026-33811

A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1341 - Multiple Releases of Same Resource or Handle
Affected products
Fixed 1 product, the same list as for CVE-2026-32281
Known not affected 6 products, the same list as for CVE-2026-32281
Threats
Impact Important
CVE-2026-33818

A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Affected products
Fixed 1 product, the same list as for CVE-2026-32281
Known not affected 6 products, the same list as for CVE-2026-32281
Threats
Impact Important
CVE-2026-42504

A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Fixed 1 product, the same list as for CVE-2026-32281
Known not affected 6 products, the same list as for CVE-2026-32281
Threats
Impact Important
CVE-2026-56860

A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-32281
Known not affected 6 products, the same list as for CVE-2026-32281
Threats
Impact Important
CVE-2026-59885

A flaw was found in pyasn1, a Python library for Abstract Syntax Notation One (ASN.1). The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker could exploit this by providing a specially crafted payload containing an OID with many arcs, leading to excessive CPU consumption and a denial of service (DoS) in applications that decode untrusted ASN.1 data. The corresponding encoders also exhibit this quadratic behavior when re-encoding attacker-supplied values.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64 —
Workaround
Unresolved product id: Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64 —
Workaround
Unresolved product id: Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64 —
Workaround
Unresolved product id: Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64 —
Workaround
Unresolved product id: Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64 —
Workaround
Unresolved product id: Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64 —
Workaround
Threats
Impact Important
CVE-2026-59886

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption, leading to a denial of service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-59885
Known not affected 6 products, the same list as for CVE-2026-59885
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:77532 self
https://access.redhat.com/security/cve/CVE-2026-32281 external
https://access.redhat.com/security/cve/CVE-2026-33811 external
https://access.redhat.com/security/cve/CVE-2026-33818 external
https://access.redhat.com/security/cve/CVE-2026-42504 external
https://access.redhat.com/security/cve/CVE-2026-56860 external
https://access.redhat.com/security/cve/CVE-2026-59885 external
https://access.redhat.com/security/cve/CVE-2026-59886 external
https://access.redhat.com/security/updates/classi… external
https://catalog.redhat.com/software/containers/search external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-32281 self
https://bugzilla.redhat.com/show_bug.cgi?id=2456333 external
https://www.cve.org/CVERecord?id=CVE-2026-32281 external
https://nvd.nist.gov/vuln/detail/CVE-2026-32281 external
https://go.dev/cl/758061 external
https://go.dev/issue/78281 external
https://groups.google.com/g/golang-announce/c/0uY… external
https://pkg.go.dev/vuln/GO-2026-4946 external
https://access.redhat.com/security/cve/CVE-2026-33811 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467822 external
https://www.cve.org/CVERecord?id=CVE-2026-33811 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33811 external
https://go.dev/cl/767860 external
https://go.dev/issue/78803 external
https://groups.google.com/g/golang-announce/c/qcC… external
https://pkg.go.dev/vuln/GO-2026-4981 external
https://access.redhat.com/security/cve/CVE-2026-33818 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515815 external
https://www.cve.org/CVERecord?id=CVE-2026-33818 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33818 external
https://go.dev/cl/814980 external
https://go.dev/issue/80405 external
https://groups.google.com/g/golang-announce/c/94p… external
https://pkg.go.dev/vuln/GO-2026-5972 external
https://access.redhat.com/security/cve/CVE-2026-42504 self
https://bugzilla.redhat.com/show_bug.cgi?id=2484204 external
https://www.cve.org/CVERecord?id=CVE-2026-42504 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42504 external
https://go.dev/cl/774481 external
https://go.dev/issue/79217 external
https://groups.google.com/g/golang-announce/c/tKs… external
https://pkg.go.dev/vuln/GO-2026-5038 external
https://access.redhat.com/security/cve/CVE-2026-56860 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515820 external
https://www.cve.org/CVERecord?id=CVE-2026-56860 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56860 external
https://go.dev/cl/803681 external
https://go.dev/issue/80494 external
https://pkg.go.dev/vuln/GO-2026-6218 external
https://access.redhat.com/security/cve/CVE-2026-59885 self
https://bugzilla.redhat.com/show_bug.cgi?id=2500380 external
https://www.cve.org/CVERecord?id=CVE-2026-59885 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59885 external
https://github.com/pyasn1/pyasn1/commit/45bdb19eb… external
https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4 external
https://github.com/pyasn1/pyasn1/security/advisor… external
https://access.redhat.com/security/cve/CVE-2026-59886 self
https://bugzilla.redhat.com/show_bug.cgi?id=2500041 external
https://www.cve.org/CVERecord?id=CVE-2026-59886 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59886 external
https://github.com/pyasn1/pyasn1/commit/e60c691cb… external
https://github.com/pyasn1/pyasn1/security/advisor… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Release of components for the Service Telemetry Framework",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Service Telemetry Framework (STF) provides automated collection of measurements and data from remote clients, such as Red Hat OpenStack Platform or third-party nodes. STF then transmits the information to a centralized, receiving Red Hat OpenShift Container Platform deployment for storage, retrieval, and monitoring.\n\nSecurity Fixes:\n* golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n* Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)\n* Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)\n* Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)\n* Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n* pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59885)\n* pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:77532",
        "url": "https://access.redhat.com/errata/RHSA-2026:77532"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32281",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32281"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33811"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33818",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42504",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42504"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56860",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59885",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59885"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59886",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59886"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/software/containers/search",
        "url": "https://catalog.redhat.com/software/containers/search"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77532.json"
      }
    ],
    "title": "Red Hat Security Advisory: Release of components for Service Telemetry Framework 1.5.7",
    "tracking": {
      "current_release_date": "2026-10-12T22:57:33+00:00",
      "generator": {
        "date": "2026-10-12T22:57:33+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2026:77532",
      "initial_release_date": "2026-10-07T09:44:11+00:00",
      "revision_history": [
        {
          "date": "2026-10-07T09:44:11+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-07T09:44:14+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-12T22:57:33+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack 1.5",
                "product": {
                  "name": "Red Hat OpenStack 1.5",
                  "product_id": "Red Hat OpenStack 1.5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:stf:1.5::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
                "product": {
                  "name": "registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
                  "product_id": "registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/prometheus-webhook-snmp-rhel9@sha256%3A4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08?arch=amd64\u0026repository_url=registry.redhat.io/stf/prometheus-webhook-snmp-rhel9\u0026tag=1790006859"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
                "product": {
                  "name": "registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
                  "product_id": "registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/service-telemetry-operator-bundle@sha256%3A9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25?arch=amd64\u0026repository_url=registry.redhat.io/stf/service-telemetry-operator-bundle\u0026tag=1790009975"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
                "product": {
                  "name": "registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
                  "product_id": "registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/service-telemetry-rhel9-operator@sha256%3A7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74?arch=amd64\u0026repository_url=registry.redhat.io/stf/service-telemetry-rhel9-operator\u0026tag=1789646923"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
                "product": {
                  "name": "registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
                  "product_id": "registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/sg-bridge-rhel9@sha256%3A03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8?arch=amd64\u0026repository_url=registry.redhat.io/stf/sg-bridge-rhel9\u0026tag=1790107693"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
                "product": {
                  "name": "registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
                  "product_id": "registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/sg-core-rhel9@sha256%3Ace27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7?arch=amd64\u0026repository_url=registry.redhat.io/stf/sg-core-rhel9\u0026tag=1790006836"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
                "product": {
                  "name": "registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
                  "product_id": "registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/smart-gateway-operator-bundle@sha256%3A5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4?arch=amd64\u0026repository_url=registry.redhat.io/stf/smart-gateway-operator-bundle\u0026tag=1790108258"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64",
                "product": {
                  "name": "registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64",
                  "product_id": "registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/smart-gateway-rhel9-operator@sha256%3A1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97?arch=amd64\u0026repository_url=registry.redhat.io/stf/smart-gateway-rhel9-operator\u0026tag=1789646936"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64 as a component of Red Hat OpenStack 1.5",
          "product_id": "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64"
        },
        "product_reference": "registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
        "relates_to_product_reference": "Red Hat OpenStack 1.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64 as a component of Red Hat OpenStack 1.5",
          "product_id": "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64"
        },
        "product_reference": "registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
        "relates_to_product_reference": "Red Hat OpenStack 1.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64 as a component of Red Hat OpenStack 1.5",
          "product_id": "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64"
        },
        "product_reference": "registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
        "relates_to_product_reference": "Red Hat OpenStack 1.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64 as a component of Red Hat OpenStack 1.5",
          "product_id": "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64"
        },
        "product_reference": "registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
        "relates_to_product_reference": "Red Hat OpenStack 1.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64 as a component of Red Hat OpenStack 1.5",
          "product_id": "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64"
        },
        "product_reference": "registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
        "relates_to_product_reference": "Red Hat OpenStack 1.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64 as a component of Red Hat OpenStack 1.5",
          "product_id": "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64"
        },
        "product_reference": "registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
        "relates_to_product_reference": "Red Hat OpenStack 1.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64 as a component of Red Hat OpenStack 1.5",
          "product_id": "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
        },
        "product_reference": "registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64",
        "relates_to_product_reference": "Red Hat OpenStack 1.5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-32281",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-04-08T02:01:00.930989+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456333"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw occurs during the validation of otherwise trusted certificate chains that contain a large number of policy mappings, leading to excessive resource consumption. Exploitation requires an attacker to present a specially crafted, yet trusted, certificate chain which would require the attacker has already compromised a trusted certificate root. Red Hat continuously monitors certificate authorities and curates the set which is trusted by default for Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64"
        ],
        "known_not_affected": [
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32281"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456333",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32281",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/758061",
          "url": "https://go.dev/cl/758061"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78281",
          "url": "https://go.dev/issue/78281"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4946",
          "url": "https://pkg.go.dev/vuln/GO-2026-4946"
        }
      ],
      "release_date": "2026-04-08T01:06:58.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T09:44:11+00:00",
          "details": "The Service Telemetry Framework container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container\nCatalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77532"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "cve": "CVE-2026-33811",
      "cwe": {
        "id": "CWE-1341",
        "name": "Multiple Releases of Same Resource or Handle"
      },
      "discovery_date": "2026-05-07T20:01:34.913869+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64"
        ],
        "known_not_affected": [
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33811"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/767860",
          "url": "https://go.dev/cl/767860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78803",
          "url": "https://go.dev/issue/78803"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4981",
          "url": "https://pkg.go.dev/vuln/GO-2026-4981"
        }
      ],
      "release_date": "2026-05-07T19:41:19.285000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T09:44:11+00:00",
          "details": "The Service Telemetry Framework container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container\nCatalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77532"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "cve": "CVE-2026-33818",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:12:37.151735+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64"
        ],
        "known_not_affected": [
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/814980",
          "url": "https://go.dev/cl/814980"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80405",
          "url": "https://go.dev/issue/80405"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5972",
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "release_date": "2026-08-13T21:58:52.821000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T09:44:11+00:00",
          "details": "The Service Telemetry Framework container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container\nCatalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77532"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "cve": "CVE-2026-42504",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-06-02T23:01:00.320527+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484204"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64"
        ],
        "known_not_affected": [
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484204",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42504",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/774481",
          "url": "https://go.dev/cl/774481"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79217",
          "url": "https://go.dev/issue/79217"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5038",
          "url": "https://pkg.go.dev/vuln/GO-2026-5038"
        }
      ],
      "release_date": "2026-06-02T22:01:37.219000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T09:44:11+00:00",
          "details": "The Service Telemetry Framework container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container\nCatalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77532"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "cve": "CVE-2026-56860",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:13:18.319384+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory (\u0027..\u0027) segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments (\u0027..\u0027) may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64"
        ],
        "known_not_affected": [
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803681",
          "url": "https://go.dev/cl/803681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80494",
          "url": "https://go.dev/issue/80494"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6218",
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "release_date": "2026-08-13T21:58:53.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T09:44:11+00:00",
          "details": "The Service Telemetry Framework container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container\nCatalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77532"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "cve": "CVE-2026-59885",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-07-14T18:17:12.157807+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500380"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pyasn1, a Python library for Abstract Syntax Notation One (ASN.1). The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker could exploit this by providing a specially crafted payload containing an OID with many arcs, leading to excessive CPU consumption and a denial of service (DoS) in applications that decode untrusted ASN.1 data. The corresponding encoders also exhibit this quadratic behavior when re-encoding attacker-supplied values.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in pyasn1. The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call, allowing denial of service in applications that decode untrusted ASN.1 data (certificates, LDAP, SNMP, Kerberos). The corresponding encoders exhibit the same behavior when re-encoding attacker-supplied values. The arc-size limit introduced for CVE-2026-23490 does not mitigate this issue. This issue is fixed in pyasn1 version 0.6.4.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64"
        ],
        "known_not_affected": [
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59885"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500380",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500380"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59885",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59885"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59885",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59885"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9",
          "url": "https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4",
          "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj",
          "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj"
        }
      ],
      "release_date": "2026-07-14T16:40:00.515000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T09:44:11+00:00",
          "details": "The Service Telemetry Framework container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container\nCatalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77532"
        },
        {
          "category": "workaround",
          "details": "Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) \u2014 an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER"
    },
    {
      "cve": "CVE-2026-59886",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-14T17:01:19.689422+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500041"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption, leading to a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in pyasn1, rated as Important, could lead to a denial of service in Red Hat products that process untrusted ASN.1 data. A remote attacker could send a specially crafted BER, CER, or DER encoded REAL value with a large exponent, causing applications to consume excessive resources during decoding operations such as printing, logging, or arithmetic, thereby rendering the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64"
        ],
        "known_not_affected": [
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
          "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59886"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500041",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500041"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59886",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59886"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59886",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59886"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886",
          "url": "https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4",
          "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r",
          "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r"
        }
      ],
      "release_date": "2026-07-14T16:38:29.691000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T09:44:11+00:00",
          "details": "The Service Telemetry Framework container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container\nCatalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77532"
        },
        {
          "category": "workaround",
          "details": "When processing untrusted ASN.1 data with pyasn1, avoid calling prettyPrint(), str(), float(), int(), or performing comparisons or arithmetic on decoded Real (ASN.1 REAL type) objects. Instead, inspect the raw (mantissa, base, exponent) tuple directly. Where logging decoded ASN.1 structures is necessary, filter out or sanitize Real-typed values before conversion.",
          "product_ids": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:4d016a5208197ddf8d28705e6d27640d4752604921050ed5aaa375d111f32d08_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:9ea1393237b591f3643af0fd2036d75d0771db85b7cf36d61aa0d8b468bc7e25_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:7e97da5b0f9bbac33646021556d7f35f3c526f6538fbaa0f0fc5b7366b672f74_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:03e5760749218cdd84e46360cb8d475586e564d7cbe72dcf233bae732698c9c8_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:ce27e2953ecba5d3cac72649da7b8490e83e655973df1c3f40560c4ea672afa7_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:5de21a496ce353c1b63241661b24b0a032c89f68ef6c9666f3fd55cf8a6701c4_amd64",
            "Red Hat OpenStack 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:1e2a937e6ba42e3288038dbee7d4963543235faca5983a746326ecc03d19db97_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.