RHSA-2026:79357
Vulnerability from csaf_redhat - Published: 2026-10-08 15:41 - Updated: 2026-10-09 09:36Summary
Red Hat Security Advisory: Red Hat Cost Management On-Premise container image update
Severity
Important
Notes
Topic: Updated container image for Red Hat Cost Management On-Premise is now available.
Details: Red Hat Cost Management On-Premise provides cost visibility and analysis for on-premise OpenShift environments. This update includes the latest bug fixes and enhancements.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different service, potentially leading to unauthorized access or information disclosure.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to compromising request integrity.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in curl. When curl is configured to use a .netrc file for credentials and a URL is provided with a username but no password, curl may incorrectly retrieve and use the password for a different user from the .netrc file for the same host. This could lead to unauthorized information disclosure, as curl might connect using unintended credentials.
4.8 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security (mTLS) settings, particularly those for client certificates, should have prevented such reuse. This issue could lead to a security feature bypass, where a client might use a connection with an unintended or weaker security configuration, potentially compromising the integrity or confidentiality of data.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in curl. When libcurl is instructed to clear proxy authentication credentials, it fails to do so, leaving the old credentials available. This could lead to the unintended reuse of sensitive proxy authentication credentials for subsequent network transfers, potentially resulting in unauthorized access or information disclosure.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in curl. When `libcurl` performs a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This could lead to unintended information disclosure, potentially allowing an attacker to gain unauthorized access to sensitive data.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in Perl. When the Perl regular expression engine processes patterns with a very large number of alternative fixed strings, an internal data field can overflow. This leads to silently incorrect regular expression matches, causing the engine to either match strings it should not (false positives) or fail to match strings it should (false negatives). If these regular expressions are used for security-sensitive operations like access control or data filtering, this flaw could result in incorrect security decisions.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.
7.0 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption can result in a Denial of Service (DoS) condition, making the QUIC listener unavailable.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.
CWE-805 - Buffer Access with Incorrect Length ValueAffected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID (destination connection ID) can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in XZ Utils. When the `lzma_index_decoder()` function processes an empty index, and a subsequent `lzma_index_append()` operation is performed, insufficient memory is allocated. This can lead to a buffer overflow, potentially causing a denial of service (DoS) for affected systems.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in gawk. A Use After Free vulnerability exists in the do_getline_redir() routine within the io.c program file. This vulnerability can be triggered by an attacker, potentially leading to a system crash and causing a Denial of Service (DoS).
4.0 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in gawk. An integer overflow vulnerability could allow a local attacker to cause memory exhaustion, leading to a denial of service. This flaw may also enable an attacker to corrupt gawk's internal memory, potentially leading to system instability.
4.4 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in gawk. A buffer overflow vulnerability exists in the `ftype()` routine, located in the `extension/readdir.c` program file. This vulnerability could allow an attacker to crash the program, resulting in a denial of service. It may also potentially lead to arbitrary code execution, though this has not been definitively confirmed.
6.2 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the `map` directive uses regular expression (regex) matching and references regex capture variables before referencing the map output variable. This can lead to a heap buffer overflow, which may allow for arbitrary code execution on systems where Address Space Layout Randomization (ASLR) is disabled or bypassed. Additionally, this flaw can cause a denial-of-service (DoS) due to the NGINX worker process restarting.
7.0 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in libexpat. This vulnerability occurs because the library, in versions before 2.8.2, does not properly track handler call depth when certain XML parsing functions are invoked from within handlers during a policy violation. This oversight can lead to a use-after-free condition, which may result in information disclosure, integrity loss, or denial of service.
4.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A time-of-check to time-of-use (TOCTOU) race condition flaw in the rrsync restricted shell wrapper allows authenticated remote attackers to escape directory restrictions. By replacing a validated path component with a symbolic link prior to file transfer execution, an attacker can bypass intended boundary controls and read or write arbitrary files outside the designated directory.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in rsync. This path traversal vulnerability allows remote clients to access files outside the intended module root. This occurs when the use chroot option is disabled and the module root path, or a component of it, is a symbolic link. The rsync daemon fails to resolve symlinks during session initialization, causing subsequent operations to reference files relative to the symlink target, leading to unauthorized file access.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A path traversal vulnerability in rsync's --relative mode allows a malicious sender to craft symlink paths, enabling arbitrary file writes outside the destination directory.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
An improper path handling vulnerability in rsync allows a remote attacker to delete arbitrary files on the receiving system. By sending a specially crafted file list during synchronization, an attacker can expand the scope of --delete operations beyond the target directory, potentially causing a denial of service.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A command injection vulnerability in rsync allows remote attackers to execute arbitrary commands by supplying shell metacharacters or newlines in unsanitized inputs, such as hostnames or hostspecs. This impacts multiple vectors—including the RSYNC_CONNECT_PROG variable, daemon hooks, rsync-ssl, and remote-shell parsing—executing commands with the privileges of the running process or user.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw in rsync allows an unauthenticated remote attacker to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address, granting unauthorized access to restricted resources.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in rsync. This vulnerability allows remote clients to bypass path confinement, a security measure designed to restrict file access. By crafting specific paths that include a '/./' boundary marker within a chroot environment, an attacker can gain unauthorized read or write access to files outside the intended module's directory. This could lead to sensitive information disclosure or data manipulation.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the `--temp-dir` or `--link-dest` options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree, potentially leading to unauthorized data modification or system disruption.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by `--files-from` or `--password-file`. This allows the attacker to read arbitrary files accessible to the rsync daemon process, leading to information disclosure.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges (such as setuid or a privileged daemon), this enables arbitrary file overwrites and local privilege escalation.
7.0 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in GNU coreutils, specifically in the `unexpand` utility. This vulnerability, a heap-based buffer overflow, occurs due to an integer overflow when `unexpand` processes unusually large tab stop values provided by a local attacker. This can lead to an undersized memory buffer, allowing subsequent operations to write beyond its boundaries. Successful exploitation can cause the `unexpand` utility to crash, potentially resulting in a denial of service or enabling further memory manipulation.
4.4 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in OpenSSL. A crafted CMS (Cryptographic Message Syntax) message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMS_decrypt(). This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap primitive. This can lead to memory corruption, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in OpenSSL. A crafted CMP (Certificate Management Protocol) message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts() function, causing excessive CPU consumption and a denial of service
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in rsync. This vulnerability allows a remote attacker to bypass hostname-based access control rules. By inducing DNS resolution failures, the rsync daemon incorrectly skips deny rules, granting unauthorized access to restricted module file trees.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in rsync. A remote attacker can exploit an algorithmic complexity vulnerability within the `hash_search()` function by sending a specially crafted file list. This can lead to the exhaustion of the receiver's CPU resources, causing a sustained denial of service (DoS).
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in the rsync-ssl wrapper script's TLS certificate validation. An on-path attacker can present self-signed or invalid certificates to intercept, decrypt, or tamper with encrypted sessions. Because rsync fails to validate the certificate against a trusted CA or verify hostname matching, this interception occurs without detection by the client.
6.8 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A denial-of-service flaw in rsync allows remote attackers to exhaust system memory and CPU. By sending requests using the --zt Zstandard compression alias, an attacker can bypass security directives and spawn an excessive number of worker threads.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in rsync. A remote attacker could exploit an out-of-bounds write vulnerability in the `read_args()` function by sending a specially crafted argument list. This could lead to corruption of adjacent memory, potentially causing a denial of service or, in some cases, arbitrary code execution.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
An out-of-bounds write vulnerability in rsync's parse_size_arg() function allows a remote attacker to cause memory corruption. The flaw is triggered when snprintf() truncates a formatted size string, resulting in an incorrect memory array index. Exploitation can lead to a denial of service and potentially compromise data integrity.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in rsync. This out-of-bounds write vulnerability allows attackers to corrupt memory by triggering specific processing on specially crafted file entries when hard-link preservation is not active. This can lead to denial of service or other unpredictable system behavior.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A path traversal and symlink vulnerability in rsync allows a malicious sender with write access to write files outside the intended directory. By exploiting symbolic links in conjunction with the --partial-dir or --backup-dir options, an attacker can bypass path restrictions to modify arbitrary system files, compromising system integrity
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in rsync. Remote unauthenticated attackers can exploit a heap out-of-bounds write vulnerability by supplying a crafted files-from entry. This entry, containing both an interior and trailing backslash, causes the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer. This can lead to information disclosure or denial of service.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain unauthorized access to restricted modules.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A denial of service flaw was found in the rsync daemon. An unauthenticated remote attacker can stall the handshake process by opening multiple concurrent connections and trickling data or stalling prior to module selection. This bypasses standard timeouts and exhausts all available connection slots, preventing legitimate clients from connecting.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.
8.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a loopback address. This vulnerability can lead to Server-Side Request Forgery (SSRF) and bypass host-based security policies.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names (IDN) to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an application might validate a URI against a security policy using one hostname, but then resolve to a different, potentially malicious, hostname. This discrepancy could allow an attacker to bypass security policies and access unauthorized resources.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier (URI) without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker's host as legitimate.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the `xmlDictAddQString` function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its integrity and confidentiality.
6.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the `xmlSnprintfElements` function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer() expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure, data corruption, or a denial of service (DoS).
6.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity.
6.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw in libxml2's XInclude processing (xmlXIncludeProcess and xmlXIncludeProcessTree) fails to propagate parser flags like XML_PARSE_NONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery (SSRF), XML External Entity (XXE) injection, or Denial of Service (DoS) attacks.
5.6 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Moderate
A flaw was found in source-map-js. This vulnerability allows a remote attacker to trigger a denial of service by providing malformed input. Specifically, by supplying extremely large offset line values in indexed source maps, the attacker can cause the service's event loop to block, making it unable to process further requests.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
A flaw was found in Expat. This vulnerability allows a remote attacker to send specially crafted UTF-16 encoded XML data. Due to improper validation of surrogate characters, the parser can be tricked into accepting malformed sequences, which can hide legitimate markup characters. This could enable XML injection attacks, potentially leading to information disclosure or other integrity impacts.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-8458
Threats
Impact
Important
References
386 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated container image for Red Hat Cost Management On-Premise is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Cost Management On-Premise provides cost visibility and analysis for on-premise OpenShift environments. This update includes the latest bug fixes and enhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:79357",
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "external",
"summary": "https://access.redhat.com/articles/7148128",
"url": "https://access.redhat.com/articles/7148128"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-11856",
"url": "https://access.redhat.com/security/cve/CVE-2026-11856"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-13221",
"url": "https://access.redhat.com/security/cve/CVE-2026-13221"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-13732",
"url": "https://access.redhat.com/security/cve/CVE-2026-13732"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14456",
"url": "https://access.redhat.com/security/cve/CVE-2026-14456"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-15028",
"url": "https://access.redhat.com/security/cve/CVE-2026-15028"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-16118",
"url": "https://access.redhat.com/security/cve/CVE-2026-16118"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-18798",
"url": "https://access.redhat.com/security/cve/CVE-2026-18798"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34743",
"url": "https://access.redhat.com/security/cve/CVE-2026-34743"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40467",
"url": "https://access.redhat.com/security/cve/CVE-2026-40467"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40468",
"url": "https://access.redhat.com/security/cve/CVE-2026-40468"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40553",
"url": "https://access.redhat.com/security/cve/CVE-2026-40553"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42533",
"url": "https://access.redhat.com/security/cve/CVE-2026-42533"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42784",
"url": "https://access.redhat.com/security/cve/CVE-2026-42784"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50219",
"url": "https://access.redhat.com/security/cve/CVE-2026-50219"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53783",
"url": "https://access.redhat.com/security/cve/CVE-2026-53783"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53784",
"url": "https://access.redhat.com/security/cve/CVE-2026-53784"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53785",
"url": "https://access.redhat.com/security/cve/CVE-2026-53785"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53789",
"url": "https://access.redhat.com/security/cve/CVE-2026-53789"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53790",
"url": "https://access.redhat.com/security/cve/CVE-2026-53790"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53791",
"url": "https://access.redhat.com/security/cve/CVE-2026-53791"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53793",
"url": "https://access.redhat.com/security/cve/CVE-2026-53793"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53795",
"url": "https://access.redhat.com/security/cve/CVE-2026-53795"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53802",
"url": "https://access.redhat.com/security/cve/CVE-2026-53802"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53803",
"url": "https://access.redhat.com/security/cve/CVE-2026-53803"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56392",
"url": "https://access.redhat.com/security/cve/CVE-2026-56392"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-63072",
"url": "https://access.redhat.com/security/cve/CVE-2026-63072"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-63076",
"url": "https://access.redhat.com/security/cve/CVE-2026-63076"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66046",
"url": "https://access.redhat.com/security/cve/CVE-2026-66046"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70452",
"url": "https://access.redhat.com/security/cve/CVE-2026-70452"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70453",
"url": "https://access.redhat.com/security/cve/CVE-2026-70453"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70454",
"url": "https://access.redhat.com/security/cve/CVE-2026-70454"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70455",
"url": "https://access.redhat.com/security/cve/CVE-2026-70455"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70456",
"url": "https://access.redhat.com/security/cve/CVE-2026-70456"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70457",
"url": "https://access.redhat.com/security/cve/CVE-2026-70457"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70458",
"url": "https://access.redhat.com/security/cve/CVE-2026-70458"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70460",
"url": "https://access.redhat.com/security/cve/CVE-2026-70460"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70461",
"url": "https://access.redhat.com/security/cve/CVE-2026-70461"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70463",
"url": "https://access.redhat.com/security/cve/CVE-2026-70463"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70464",
"url": "https://access.redhat.com/security/cve/CVE-2026-70464"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-74860",
"url": "https://access.redhat.com/security/cve/CVE-2026-74860"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-75899",
"url": "https://access.redhat.com/security/cve/CVE-2026-75899"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-75931",
"url": "https://access.redhat.com/security/cve/CVE-2026-75931"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-84292",
"url": "https://access.redhat.com/security/cve/CVE-2026-84292"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-8458",
"url": "https://access.redhat.com/security/cve/CVE-2026-8458"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86138",
"url": "https://access.redhat.com/security/cve/CVE-2026-86138"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86140",
"url": "https://access.redhat.com/security/cve/CVE-2026-86140"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86142",
"url": "https://access.redhat.com/security/cve/CVE-2026-86142"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86143",
"url": "https://access.redhat.com/security/cve/CVE-2026-86143"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86144",
"url": "https://access.redhat.com/security/cve/CVE-2026-86144"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-8924",
"url": "https://access.redhat.com/security/cve/CVE-2026-8924"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-8926",
"url": "https://access.redhat.com/security/cve/CVE-2026-8926"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-8932",
"url": "https://access.redhat.com/security/cve/CVE-2026-8932"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-9079",
"url": "https://access.redhat.com/security/cve/CVE-2026-9079"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-93749",
"url": "https://access.redhat.com/security/cve/CVE-2026-93749"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-93990",
"url": "https://access.redhat.com/security/cve/CVE-2026-93990"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification",
"url": "https://access.redhat.com/security/updates/classification"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/cost_management_service/1-latest/html/getting_started_with_cost_management/steps-to-cost-management",
"url": "https://docs.redhat.com/en/documentation/cost_management_service/1-latest/html/getting_started_with_cost_management/steps-to-cost-management"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79357.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Cost Management On-Premise container image update",
"tracking": {
"current_release_date": "2026-10-09T09:36:51+00:00",
"generator": {
"date": "2026-10-09T09:36:51+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.2"
}
},
"id": "RHSA-2026:79357",
"initial_release_date": "2026-10-08T15:41:00+00:00",
"revision_history": [
{
"date": "2026-10-08T15:41:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-08T15:41:02+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-09T09:36:51+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Cost Management On-Premise 1",
"product": {
"name": "Red Hat Cost Management On-Premise 1",
"product_id": "Red Hat Cost Management On-Premise 1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:cost_management_on_premise:1::el10"
}
}
}
],
"category": "product_family",
"name": "Red Hat Cost Management On-Premise"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64",
"product": {
"name": "registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64",
"product_id": "registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/costmanagement-ui-rhel10@sha256%3A39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d?arch=amd64\u0026repository_url=registry.redhat.io/costmanagement/costmanagement-ui-rhel10\u0026tag=1791460851"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64 as a component of Red Hat Cost Management On-Premise 1",
"product_id": "Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
},
"product_reference": "registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64",
"relates_to_product_reference": "Red Hat Cost Management On-Premise 1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-8458",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"discovery_date": "2026-07-03T07:01:30.042181+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496764"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different service, potentially leading to unauthorized access or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: libcurl: Unauthorized connection reuse due to a logical error",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in libcurl where a logical error in connection pooling can lead to unauthorized connection reuse. When an application uses Negotiate authentication with different service names on the same hostname and port, libcurl might incorrectly reuse an existing authenticated connection for an unintended service. This could result in information disclosure or unauthorized access to resources, bypassing intended service isolation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8458"
},
{
"category": "external",
"summary": "RHBZ#2496764",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496764"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8458"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8458.html",
"url": "https://curl.se/docs/CVE-2026-8458.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8458.json",
"url": "https://curl.se/docs/CVE-2026-8458.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3721183",
"url": "https://hackerone.com/reports/3721183"
}
],
"release_date": "2026-07-03T06:14:42.258000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "curl: libcurl: Unauthorized connection reuse due to a logical error"
},
{
"cve": "CVE-2026-8924",
"cwe": {
"id": "CWE-565",
"name": "Reliance on Cookies without Validation and Integrity Checking"
},
"discovery_date": "2026-07-03T07:01:32.981435+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496765"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl\u0027s cookie parsing logic. A malicious HTTP server can exploit this by setting \u0027super cookies\u0027 that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to compromising request integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Cookie injection via malicious HTTP server using super cookies",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: Red Hat rates this flaw Moderate (CVSS 6.5) compared to CISA\u0027s Critical (9.1). The scoring difference is due to two factors: first, exploitation requires the victim\u0027s curl to connect using a trailing-dot hostname (e.g., https://example.co.uk.), a format that is uncommon in practice and incompatible with TLS SNI; second, the direct impact is cookie injection into outbound requests \u2014 not exfiltration of victim data to the attacker. The curl project itself rates this flaw Low severity. Red Hat products that use curl for HTTP communication are affected, but the trailing-dot precondition significantly limits real-world exploitability. This flaw has not been shown to enable impacts beyond session integrity modification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8924"
},
{
"category": "external",
"summary": "RHBZ#2496765",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496765"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8924",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8924"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8924",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8924"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8924.html",
"url": "https://curl.se/docs/CVE-2026-8924.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8924.json",
"url": "https://curl.se/docs/CVE-2026-8924.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3733905",
"url": "https://hackerone.com/reports/3733905"
}
],
"release_date": "2026-07-03T06:15:04.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Do not use trailing-dot hostnames in URLs passed to curl. Trailing dots are uncommon and incompatible with TLS SNI. Upgrade to curl 8.21.0 to resolve",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Cookie injection via malicious HTTP server using super cookies"
},
{
"cve": "CVE-2026-8926",
"cwe": {
"id": "CWE-289",
"name": "Authentication Bypass by Alternate Name"
},
"discovery_date": "2026-07-03T07:01:18.157468+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496760"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When curl is configured to use a .netrc file for credentials and a URL is provided with a username but no password, curl may incorrectly retrieve and use the password for a different user from the .netrc file for the same host. This could lead to unauthorized information disclosure, as curl might connect using unintended credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Information disclosure via incorrect .netrc password lookup",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8926"
},
{
"category": "external",
"summary": "RHBZ#2496760",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496760"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8926",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8926"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8926",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8926"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8926.html",
"url": "https://curl.se/docs/CVE-2026-8926.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8926.json",
"url": "https://curl.se/docs/CVE-2026-8926.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3735184",
"url": "https://hackerone.com/reports/3735184"
}
],
"release_date": "2026-07-03T06:15:45.735000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Information disclosure via incorrect .netrc password lookup"
},
{
"cve": "CVE-2026-8932",
"cwe": {
"id": "CWE-1025",
"name": "Comparison Using Wrong Factors"
},
"discovery_date": "2026-07-03T07:01:15.122562+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496759"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security (mTLS) settings, particularly those for client certificates, should have prevented such reuse. This issue could lead to a security feature bypass, where a client might use a connection with an unintended or weaker security configuration, potentially compromising the integrity or confidentiality of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important security feature bypass in libcurl where mTLS connection reuse may occur despite changes to client certificate settings. This could lead to applications using libcurl with mTLS to inadvertently use a less secure connection than intended, potentially compromising data confidentiality or integrity. This issue primarily affects applications that dynamically alter mTLS client certificate configurations and reuse connections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8932"
},
{
"category": "external",
"summary": "RHBZ#2496759",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496759"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8932",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8932"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8932",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8932"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8932.html",
"url": "https://curl.se/docs/CVE-2026-8932.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8932.json",
"url": "https://curl.se/docs/CVE-2026-8932.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3733910",
"url": "https://hackerone.com/reports/3733910"
}
],
"release_date": "2026-07-03T06:16:30.485000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse"
},
{
"cve": "CVE-2026-9079",
"cwe": {
"id": "CWE-212",
"name": "Improper Removal of Sensitive Information Before Storage or Transfer"
},
"discovery_date": "2026-07-03T07:01:50.605956+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496771"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When libcurl is instructed to clear proxy authentication credentials, it fails to do so, leaving the old credentials available. This could lead to the unintended reuse of sensitive proxy authentication credentials for subsequent network transfers, potentially resulting in unauthorized access or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in libcurl\u0027s proxy authentication credential management can lead to information disclosure. There are no integrity or availability risks posed by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-9079"
},
{
"category": "external",
"summary": "RHBZ#2496771",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496771"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-9079",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9079"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9079",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9079"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-9079.html",
"url": "https://curl.se/docs/CVE-2026-9079.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-9079.json",
"url": "https://curl.se/docs/CVE-2026-9079.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3750295",
"url": "https://hackerone.com/reports/3750295"
}
],
"release_date": "2026-07-03T06:16:51.127000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials"
},
{
"cve": "CVE-2026-11856",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-07-03T07:01:38.848109+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496767"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When `libcurl` performs a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This could lead to unintended information disclosure, potentially allowing an attacker to gain unauthorized access to sensitive data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Information disclosure via incorrect Digest authentication header reuse",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate-severity flaw in `libcurl` can lead to information disclosure when an application reuses a `libcurl` handle for transfers to different HTTP origins while using Digest authentication. The vulnerability arises from `libcurl` incorrectly sending the authentication header intended for the initial origin to a subsequent, different origin. This could expose sensitive authentication data to an unintended recipient, potentially compromising user credentials or session information. The only observed impact from this flaw is an integrity impact.\n\n- libcurl only \u2014 the curl CLI is not affected\n- Requires an application to reuse an easy handle across different HTTP origins while Digest auth state is attached \u2014 a specific programming pattern\n- Credentials themselves are not leaked; only the authenticated state (\"Authorization: ...\" HTTP header)\n- Fixed in curl 8.21.0; affected range: 7.10.6 \u2013 8.20.0",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11856"
},
{
"category": "external",
"summary": "RHBZ#2496767",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496767"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11856",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11856"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11856",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11856"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-11856.html",
"url": "https://curl.se/docs/CVE-2026-11856.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-11856.json",
"url": "https://curl.se/docs/CVE-2026-11856.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3793260",
"url": "https://hackerone.com/reports/3793260"
}
],
"release_date": "2026-07-03T06:13:31.661000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 \u2013 8.20.0",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Information disclosure via incorrect Digest authentication header reuse"
},
{
"cve": "CVE-2026-13221",
"cwe": {
"id": "CWE-625",
"name": "Permissive Regular Expression"
},
"discovery_date": "2026-07-13T17:01:13.173015+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499727"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Perl. When the Perl regular expression engine processes patterns with a very large number of alternative fixed strings, an internal data field can overflow. This leads to silently incorrect regular expression matches, causing the engine to either match strings it should not (false positives) or fail to match strings it should (false negatives). If these regular expressions are used for security-sensitive operations like access control or data filtering, this flaw could result in incorrect security decisions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "perl: Perl: Incorrect regular expression processing via large regular expressions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this vulnerability moderate as exploiting it requires local access as well as complex buffer overflows to get access to running arbitrary code. Also a successful attack will depend strongly on the script that is housing the vulnerable regular expression. No production script should implicitly trust data and make security decisions, so the impact for a successful exploitation is very low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13221"
},
{
"category": "external",
"summary": "RHBZ#2499727",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499727"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13221",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13221"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13221",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13221"
},
{
"category": "external",
"summary": "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch",
"url": "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch"
},
{
"category": "external",
"summary": "https://github.com/Perl/perl5/issues/23388",
"url": "https://github.com/Perl/perl5/issues/23388"
}
],
"release_date": "2026-07-13T15:40:11.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "perl: Perl: Incorrect regular expression processing via large regular expressions"
},
{
"acknowledgments": [
{
"names": [
"JD Marsters"
],
"organization": "Bhut Red"
}
],
"cve": "CVE-2026-13732",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-06-29T14:42:56.970000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494416"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GDB\u0027s STABS debug format parser. The\nread_member_functions() function in gdb/stabsread.c contains a linked\nlist removal bug in the code that separates destructor and non-destructor\nmember functions of C++ classes. The bug causes the destructor entries to\nremain in the main function list while the list length counter is\ndecremented, resulting in an out-of-bounds write when the function list\nis copied to its final allocated array. An attacker can craft an ELF\nbinary with malicious .stab and .stabstr sections that triggers this\nout-of-bounds write when a user opens the file in GDB and performs any\nsymbol-inspection operation such as setting a breakpoint. The inferior\nprocess does not need to be executed. Under controlled conditions, this\nwas demonstrated to achieve execution of arbitrary commands within the\nGDB process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw affects the STABS debug format parser in GDB, which is present\nand active in all currently supported Red Hat product streams that ship\nGDB. The STABS format is a legacy debug information format predating DWARF\nthat GDB parses automatically from .stab/.stabstr ELF sections. While GCC\nremoved STABS emitting support in GCC 13 and GDB deprecated STABS parsing\nin GDB 17, all deployed GDB versions parse STABS data without user opt-in.\nAn attacker can embed STABS sections in any ELF binary, including one\ncompiled with DWARF debug information, and GDB will parse both. The\nvulnerability requires the user to open the crafted binary in GDB and\nissue a symbol-inspection command, which is normal GDB usage.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13732"
},
{
"category": "external",
"summary": "RHBZ#2494416",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494416"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13732"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13732",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13732"
}
],
"release_date": "2026-08-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "The following practices would help for avoiding exposure and mitigate this\nflaw:\n- Do not open untrusted or unknown ELF binaries in GDB without first\n stripping debug sections. Use `objcopy --remove-section=.stab\n --remove-section=.stabstr \u003cbinary\u003e` before debugging.\n- Use `readelf -S \u003cbinary\u003e | grep stab` to check for the presence of\n STABS sections before opening a binary in GDB. Legitimate modern\n binaries use DWARF, not STABS.\n- Consider using LLDB or other debuggers that do not support STABS for\n analysis of untrusted binaries.\n- For automated environments (CI, test farms) that invoke GDB on\n potentially untrusted binaries, run GDB in a sandboxed or containerized\n environment with restricted filesystem access.\n- GDB 17+ deprecates STABS support but still parses it. GDB 18 (expected\n late 2026/2027) will remove STABS support entirely.\n- GCC removed STABS emitting in GCC 13 (2023), so legitimately compiled\n binaries from recent GCC versions will not contain STABS data.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF"
},
{
"cve": "CVE-2026-14456",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-13T14:21:24.109249+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515348"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption can result in a Denial of Service (DoS) condition, making the QUIC listener unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux 9.8+, 10.2+, Red Hat Hardened Images, RHIVOS 2, and OpenShift 4.22 ship OpenSSL 3.5.x which includes the QUIC server implementation affected by this flaw. Earlier RHEL versions ship OpenSSL 3.2.x or below, which do not include the QUIC server feature and are not affected. The FIPS module is not affected as the QUIC implementation is outside the OpenSSL FIPS module boundary. Applications must explicitly enable the QUIC server listener to be vulnerable; simply having OpenSSL 3.5 installed does not expose the flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14456"
},
{
"category": "external",
"summary": "RHBZ#2515348",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515348"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14456"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14456",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14456"
},
{
"category": "external",
"summary": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9",
"url": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9"
},
{
"category": "external",
"summary": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b",
"url": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b"
},
{
"category": "external",
"summary": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139",
"url": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260813.txt",
"url": "https://openssl-library.org/news/secadv/20260813.txt"
}
],
"release_date": "2026-08-13T13:55:52.370000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Option 1: Rate-limit or Firewall Inbound QUIC (UDP 443) [Goal: Slow or block QUIC Initial packets before they reach the vulnerable listener.]\n\nA. Confirm QUIC Exposure - Check if any service is listening on UDP 443:\n~~~\n$ ss -ulnp | grep \u0027:443\u0027\n# or\n$ sudo lsof -iUDP:443 -n -P\n~~~\n\nNote: If no service is listening on UDP 443, this CVE does not apply (TCP 443 is unaffected).\n\nB. Restrict Access to UDP 443 ( Default-deny UDP 443 and allow only trusted networks:)\n~~~\n$ sudo firewall-cmd --permanent --remove-service=quic 2\u003e/dev/null\n$ sudo firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"10.0.0.0/8\" port port=\"443\" protocol=\"udp\" accept\u0027\n$ sudo firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" port port=\"443\" protocol=\"udp\" drop\u0027\n$ sudo firewall-cmd --reload\n~~~\n\nC. Verify - Confirm the restriction by testing from an external host (the connection should fail or be throttled):\n~~~\n$ nc -u -v YOUR_HOST 443\n~~~\n\nOption 2: Disable QUIC Server\n\nIf QUIC/HTTP3 is not required, remove the vulnerable code path entirely and use TLS/TCP instead.\n\nRecommended Mitigation Priority\nPriority : Action\n1.Confirm UDP 443 QUIC listener exists and OpenSSL version is in affected range\n2.Block or rate-limit UDP 443 at firewall/edge (immediate)\n3.Disable QUIC/HTTP3 on the service if not needed\n4.Upgrade OpenSSL to fixed release when available\n5.Application owners: set SSL_VALUE_QUIC_MAX_PENDING_CONNS if default 256 is too high",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server"
},
{
"cve": "CVE-2026-15028",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"discovery_date": "2026-07-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497970"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Conditions for Exploitation: Successful exploitation requires user interaction or a specific application workflow. An attacker cannot trigger this flaw entirely on their own remotely; they must supply a specially crafted tar archive and rely on a user or an automated system (such as an antivirus scanner or file extraction tool) to actively parse it using the libarchive library.\n\nImpact Limitations: Although the heap overflow has the potential to allow for arbitrary code execution, achieving this reliably is typically complex and highly dependent on the memory layout and protections of the specific application utilizing the library. In most common scenarios, the malformed archive will simply cause the parsing application to crash, resulting in a localized Denial of Service (DoS) rather than a full system compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15028"
},
{
"category": "external",
"summary": "RHBZ#2497970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497970"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15028",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15028"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15028",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15028"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/issues/3251",
"url": "https://github.com/libarchive/libarchive/issues/3251"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/pull/3253",
"url": "https://github.com/libarchive/libarchive/pull/3253"
}
],
"release_date": "2026-07-08T10:10:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid processing untrusted or unverified tar archives. Users should exercise caution when handling archives from unknown sources or those with unexpected content, as processing a specially crafted archive could trigger the vulnerability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.9,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header"
},
{
"acknowledgments": [
{
"names": [
"asotyc"
]
}
],
"cve": "CVE-2026-16118",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-07-17T13:20:23.862000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2501732"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker must convince a user to install a malicious MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) and process it with an application performing MIME type detection, limiting its exposure. Also, only little-endian systems are vulnerable. Due to these reasons, this issue has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16118"
},
{
"category": "external",
"summary": "RHBZ#2501732",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501732"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16118"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16118",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16118"
},
{
"category": "external",
"summary": "https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41",
"url": "https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41"
}
],
"release_date": "2026-07-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Do not install a MIME magic file or content from untrusted sources.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c"
},
{
"cve": "CVE-2026-18798",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"discovery_date": "2026-08-17T19:14:03.992000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517559"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID (destination connection ID) can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: QUIC server may trigger double free when processing INITIAL packet",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue can cause memory corruption due to the double free of the QRX object. However, there is currently no evidence it allows remote code execution, limiting the impact of this vulnerability to a denial of service. For these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18798"
},
{
"category": "external",
"summary": "RHBZ#2517559",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517559"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18798",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18798"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18798",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18798"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260825.txt",
"url": "https://openssl-library.org/news/secadv/20260825.txt"
}
],
"release_date": "2026-08-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: QUIC server may trigger double free when processing INITIAL packet"
},
{
"cve": "CVE-2026-34743",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-02T19:02:56.599601+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2454589"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in XZ Utils. When the `lzma_index_decoder()` function processes an empty index, and a subsequent `lzma_index_append()` operation is performed, insufficient memory is allocated. This can lead to a buffer overflow, potentially causing a denial of service (DoS) for affected systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "xz: XZ Utils: Denial of Service via buffer overflow in index decoding",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34743"
},
{
"category": "external",
"summary": "RHBZ#2454589",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454589"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34743",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34743"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34743",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34743"
},
{
"category": "external",
"summary": "https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87",
"url": "https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87"
},
{
"category": "external",
"summary": "https://github.com/tukaani-project/xz/releases/tag/v5.8.3",
"url": "https://github.com/tukaani-project/xz/releases/tag/v5.8.3"
},
{
"category": "external",
"summary": "https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv",
"url": "https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv"
}
],
"release_date": "2026-04-02T18:36:37.450000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "xz: XZ Utils: Denial of Service via buffer overflow in index decoding"
},
{
"cve": "CVE-2026-40467",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-07-13T13:01:40.927366+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499658"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gawk. A Use After Free vulnerability exists in the do_getline_redir() routine within the io.c program file. This vulnerability can be triggered by an attacker, potentially leading to a system crash and causing a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: A Use After Free vulnerability in gawk\u0027s `do_getline_redir()` routine can lead to a denial of service. This flaw, affecting gawk in Red Hat Hardened Images, requires a local attacker with low privileges to trick a user into interacting with specially crafted input, limiting its immediate impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40467"
},
{
"category": "external",
"summary": "RHBZ#2499658",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499658"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40467",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40467"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40467",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40467"
},
{
"category": "external",
"summary": "https://cert.pl/en/posts/2026/07/CVE-2026-40467",
"url": "https://cert.pl/en/posts/2026/07/CVE-2026-40467"
},
{
"category": "external",
"summary": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=a2d18c74109e41bec29a23098eba2e00057286d8",
"url": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=a2d18c74109e41bec29a23098eba2e00057286d8"
}
],
"release_date": "2026-07-13T12:07:52.006000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c"
},
{
"cve": "CVE-2026-40468",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-07-13T13:01:04.393054+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499655"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gawk. An integer overflow vulnerability could allow a local attacker to cause memory exhaustion, leading to a denial of service. This flaw may also enable an attacker to corrupt gawk\u0027s internal memory, potentially leading to system instability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gawk: gawk: Memory corruption via integer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: An integer overflow vulnerability in gawk\u0027s builtin.c could allow a local attacker to cause memory exhaustion and overwrite heap metadata. This could lead to system instability or a denial of service on affected Red Hat products, requiring local access to execute a malicious gawk script.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40468"
},
{
"category": "external",
"summary": "RHBZ#2499655",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499655"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40468",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40468"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40468",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40468"
},
{
"category": "external",
"summary": "https://cert.pl/en/posts/2026/07/CVE-2026-40467",
"url": "https://cert.pl/en/posts/2026/07/CVE-2026-40467"
},
{
"category": "external",
"summary": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7",
"url": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7"
}
],
"release_date": "2026-07-13T12:07:54.910000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gawk: gawk: Memory corruption via integer overflow"
},
{
"cve": "CVE-2026-40553",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2026-07-13T13:01:32.299484+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499657"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gawk. A buffer overflow vulnerability exists in the `ftype()` routine, located in the `extension/readdir.c` program file. This vulnerability could allow an attacker to crash the program, resulting in a denial of service. It may also potentially lead to arbitrary code execution, though this has not been definitively confirmed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: A buffer overflow in gawk\u0027s `ftype()` routine, when processing untrusted input, could lead to a denial of service or potentially arbitrary code execution. This is rated Moderate as successful exploitation requires user interaction, such as processing a specially crafted file.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40553"
},
{
"category": "external",
"summary": "RHBZ#2499657",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499657"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40553"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40553",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40553"
},
{
"category": "external",
"summary": "https://cert.pl/en/posts/2026/07/CVE-2026-40467",
"url": "https://cert.pl/en/posts/2026/07/CVE-2026-40467"
},
{
"category": "external",
"summary": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=cca0366144336b49aaa7d5d949966ce8e2c70843",
"url": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=cca0366144336b49aaa7d5d949966ce8e2c70843"
}
],
"release_date": "2026-07-13T12:07:56.611000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat\u0027s built-in memory protections will safely crash the program, preventing malicious code execution.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service"
},
{
"cve": "CVE-2026-42533",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-07-15T15:01:51.992917+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500967"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the `map` directive uses regular expression (regex) matching and references regex capture variables before referencing the map output variable. This can lead to a heap buffer overflow, which may allow for arbitrary code execution on systems where Address Space Layout Randomization (ASLR) is disabled or bypassed. Additionally, this flaw can cause a denial-of-service (DoS) due to the NGINX worker process restarting.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nginx: NGINX: Arbitrary code execution via crafted HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in NGINX allows a remote, unauthenticated attacker to trigger a heap buffer overflow, leading to a denial of service (Dos). This occurs when the `map` directive uses regex matching and references regex capture variables before the map output variable. While arbitrary code execution is a theoretical risk, it is significantly reduced on Red Hat systems where Address Space Layout Randomization (ASLR) is enabled by default.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42533"
},
{
"category": "external",
"summary": "RHBZ#2500967",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500967"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42533",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42533"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42533",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42533"
},
{
"category": "external",
"summary": "https://my.f5.com/manage/s/article/K000162097",
"url": "https://my.f5.com/manage/s/article/K000162097"
}
],
"release_date": "2026-07-15T14:33:45.810000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nginx: NGINX: Arbitrary code execution via crafted HTTP requests"
},
{
"cve": "CVE-2026-42784",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-30T14:05:14.410000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464122"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in the `sequoia-openpgp` library allows for a critical compromise of cryptographic integrity. By exploiting a key flag confusion, an attacker can bypass signature validation, enabling the forgery of signatures and illegitimate binding of subkeys. This could impact Red Hat products that utilize `sequoia-openpgp` for OpenPGP operations, potentially leading to unauthorized actions or data manipulation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42784"
},
{
"category": "external",
"summary": "RHBZ#2464122",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464122"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42784",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42784"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42784",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42784"
}
],
"release_date": "2026-09-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion"
},
{
"cve": "CVE-2026-50219",
"cwe": {
"id": "CWE-911",
"name": "Improper Update of Reference Count"
},
"discovery_date": "2026-06-04T06:01:07.420180+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484620"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libexpat. This vulnerability occurs because the library, in versions before 2.8.2, does not properly track handler call depth when certain XML parsing functions are invoked from within handlers during a policy violation. This oversight can lead to a use-after-free condition, which may result in information disclosure, integrity loss, or denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50219"
},
{
"category": "external",
"summary": "RHBZ#2484620",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484620"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50219"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50219",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50219"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/pull/1246",
"url": "https://github.com/libexpat/libexpat/pull/1246"
}
],
"release_date": "2026-06-04T04:20:32.666000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking"
},
{
"cve": "CVE-2026-53783",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-13T15:14:11.047721+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515419"
}
],
"notes": [
{
"category": "description",
"text": "A time-of-check to time-of-use (TOCTOU) race condition flaw in the rrsync restricted shell wrapper allows authenticated remote attackers to escape directory restrictions. By replacing a validated path component with a symbolic link prior to file transfer execution, an attacker can bypass intended boundary controls and read or write arbitrary files outside the designated directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Directory escape via TOCTOU race condition in rrsync",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An Important TOCTOU race condition in rsync\u0027s rrsync wrapper allows authenticated users to manipulate symlinks and escape directory boundaries, granting unauthorized read and write access to files outside the intended subtree.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53783"
},
{
"category": "external",
"summary": "RHBZ#2515419",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515419"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53783",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53783"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53783",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53783"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-escape-via-rrsync",
"url": "https://www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-escape-via-rrsync"
}
],
"release_date": "2026-08-13T14:34:07.144000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Do not use the rrsync SSH forced-command wrapper until patched packages are applied. If restricted rsync over SSH is strictly required, grant access only to SSH identities that are fully trusted with the host account\u0027s entire filesystem privileges, as rrsync cannot safely enforce directory boundaries. Note that standard rsync daemon firewall controls (TCP 873) do not mitigate this flaw, as execution occurs entirely over SSH (TCP 22).",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Directory escape via TOCTOU race condition in rrsync"
},
{
"cve": "CVE-2026-53784",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-13T15:12:09.260160+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515384"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. This path traversal vulnerability allows remote clients to access files outside the intended module root. This occurs when the use chroot option is disabled and the module root path, or a component of it, is a symbolic link. The rsync daemon fails to resolve symlinks during session initialization, causing subsequent operations to reference files relative to the symlink target, leading to unauthorized file access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Unauthorized File Access via Symlink Module Root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. The rsync daemon is vulnerable to unauthorized file access via path traversal when configured with a symlinked module root and the `use chroot` option is explicitly disabled. This configuration is not default, but if present, a local attacker with low privileges could exploit this to read or write files outside the intended module root.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53784"
},
{
"category": "external",
"summary": "RHBZ#2515384",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515384"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53784",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53784"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53784",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53784"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-ffg2-fr5g-3rxw",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-ffg2-fr5g-3rxw"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-path-traversal-via-symlink-module-root",
"url": "https://www.vulncheck.com/advisories/rsync-path-traversal-via-symlink-module-root"
}
],
"release_date": "2026-08-13T14:34:22.543000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that the `use chroot` option is enabled in the rsync daemon configuration. If `use chroot` cannot be enabled, avoid using symlinks as the module root path or any of its components in the rsync daemon configuration. After modifying the rsync configuration, restart the rsync service for the changes to take effect.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Unauthorized File Access via Symlink Module Root"
},
{
"cve": "CVE-2026-53785",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-13T15:14:03.538934+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515417"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal vulnerability in rsync\u0027s --relative mode allows a malicious sender to craft symlink paths, enabling arbitrary file writes outside the destination directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Arbitrary file write via path traversal in --relative mode",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in rsync where a malicious sender can achieve arbitrary file writes on a receiving system when the `--relative` mode is used. This path traversal flaw allows symlink components in relative paths to escape the intended destination directory. The risk is present in environments where rsync is configured to pull data from untrusted sources with the `--relative` option.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53785"
},
{
"category": "external",
"summary": "RHBZ#2515417",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515417"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53785",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53785"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53785",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53785"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pph3-7xmf-rrqg",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pph3-7xmf-rrqg"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-path-traversal-write-escape-via-relative-mode",
"url": "https://www.vulncheck.com/advisories/rsync-path-traversal-write-escape-via-relative-mode"
}
],
"release_date": "2026-08-13T14:34:59.757000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid using the rsync --relative (-R) option when synchronizing with untrusted senders. Because kernel-level symlink protections cannot prevent rsync from following malicious destination-tree symlinks created by the same executing user, strict sender verification is required. Restricting --relative operations to fully trusted sources prevents attackers from exploiting implied relative paths to achieve path traversal.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Arbitrary file write via path traversal in --relative mode"
},
{
"cve": "CVE-2026-53789",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-13T15:11:39.753005+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515375"
}
],
"notes": [
{
"category": "description",
"text": "An improper path handling vulnerability in rsync allows a remote attacker to delete arbitrary files on the receiving system. By sending a specially crafted file list during synchronization, an attacker can expand the scope of --delete operations beyond the target directory, potentially causing a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Arbitrary file deletion via malicious file list",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: This flaw in rsync allows a malicious sender to delete arbitrary files on the receiving system when the `--delete` option is used. This impact is limited to scenarios where rsync is configured to synchronize data from an untrusted source with deletion enabled, potentially leading to data loss beyond the intended sync target.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53789"
},
{
"category": "external",
"summary": "RHBZ#2515375",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515375"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53789",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53789"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53789",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53789"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-fxwg-7hmf-xh5q",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-fxwg-7hmf-xh5q"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-deletion-via-malicious-file-list",
"url": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-deletion-via-malicious-file-list"
}
],
"release_date": "2026-08-13T14:37:14.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "To reduce the risk of arbitrary file deletion, ensure that rsync operations using the `--delete` option are only performed with trusted remote sources. If rsync is configured as a daemon (`rsyncd`), restrict network access to the rsync service (port 873/tcp) to only trusted clients using firewall rules. For example, using `firewall-cmd` on Red Hat Enterprise Linux:\n`firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"\u003cTRUSTED_IP_ADDRESS\u003e\" port port=\"873\" protocol=\"tcp\" accept\u0027`\n`firewall-cmd --reload`\nThis may impact legitimate rsync operations from untrusted networks. A service reload or restart may be required for changes to take effect.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: rsync: Arbitrary file deletion via malicious file list"
},
{
"cve": "CVE-2026-53790",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-08-13T15:11:43.321109+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515378"
}
],
"notes": [
{
"category": "description",
"text": "A command injection vulnerability in rsync allows remote attackers to execute arbitrary commands by supplying shell metacharacters or newlines in unsanitized inputs, such as hostnames or hostspecs. This impacts multiple vectors\u2014including the RSYNC_CONNECT_PROG variable, daemon hooks, rsync-ssl, and remote-shell parsing\u2014executing commands with the privileges of the running process or user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync \u003c 3.5.0 Command Injection via Multiple Code Paths",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in rsync allows for remote command injection due to insufficient sanitization of user-supplied input across multiple code paths. While the attack complexity is high, successful exploitation could lead to arbitrary command execution under the privileges of the rsync process or the invoking user, impacting confidentiality, integrity, and availability. This risk is particularly relevant in environments where rsync is used for remote synchronization with untrusted sources or destinations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53790"
},
{
"category": "external",
"summary": "RHBZ#2515378",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515378"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53790",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53790"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53790",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53790"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-paths",
"url": "https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-paths"
}
],
"release_date": "2026-08-13T14:37:41.052000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Do not set RSYNC_CONNECT_PROG or pass untrusted hostnames/paths into rsync / rsync-ssl. If rsyncd is required, omit pre-xfer/post-xfer/early exec unless the command ignores client-controlled RSYNC_* values, and restrict TCP/873 to trusted clients",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync \u003c 3.5.0 Command Injection via Multiple Code Paths"
},
{
"cve": "CVE-2026-53791",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2026-08-13T15:12:20.428986+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515387"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in rsync allows an unauthenticated remote attacker to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address, granting unauthorized access to restricted resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync \u003c 3.5.0 Daemon IP Spoofing via PROXY Protocol Header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the rsync daemon. When configured to use the PROXY protocol, an unauthenticated remote attacker can bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address. This allows unauthorized access to restricted resources.\n\nNote: Red Hat Enterprise Linux 8 and earlier versions do not contain the vulnerable PROXY protocol implementation and are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53791"
},
{
"category": "external",
"summary": "RHBZ#2515387",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515387"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53791",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53791"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53791",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53791"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-h2q9-5fr8-w635",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-h2q9-5fr8-w635"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protocol-header",
"url": "https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protocol-header"
}
],
"release_date": "2026-08-13T14:38:10.300000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Restrict rsync daemon TCP/873 to the trusted proxy only (CME-202). If PROXY protocol is unused, leave proxy protocol disabled (the default).",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync \u003c 3.5.0 Daemon IP Spoofing via PROXY Protocol Header"
},
{
"cve": "CVE-2026-53793",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-13T15:12:45.432498+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515396"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. This vulnerability allows remote clients to bypass path confinement, a security measure designed to restrict file access. By crafting specific paths that include a \u0027/./\u0027 boundary marker within a chroot environment, an attacker can gain unauthorized read or write access to files outside the intended module\u0027s directory. This could lead to sensitive information disclosure or data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync \u003c 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important rsync flaw enables remote clients to bypass path confinement when the daemon operates in chroot mode with a module root containing a `/./` boundary marker. Successful exploitation could lead to unauthorized read and write access to files outside the intended chroot environment, though the attack complexity is high.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53793"
},
{
"category": "external",
"summary": "RHBZ#2515396",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515396"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53793",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53793"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53793",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53793"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-wj7w-vh23-mm44",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-wj7w-vh23-mm44"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-path-confinement-bypass-via-boundary-marker-in-chroot-mode",
"url": "https://www.vulncheck.com/advisories/rsync-path-confinement-bypass-via-boundary-marker-in-chroot-mode"
}
],
"release_date": "2026-08-13T14:38:42.288000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid configuring rsync modules with a /./ boundary marker in their root path when operating in chroot mode. Review existing rsync configurations to ensure that module root paths do not contain /./ when chroot is enabled. If chroot mode is not strictly required for a given rsync module, consider disabling it. If changes are made to the rsync configuration, a restart of the rsync service may be required for the changes to take effect.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync \u003c 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode"
},
{
"cve": "CVE-2026-53795",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-13T15:12:23.902476+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515389"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the `--temp-dir` or `--link-dest` options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree, potentially leading to unauthorized data modification or system disruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in rsync allows an attacker to write files to arbitrary locations outside the intended destination. This occurs when a user is tricked into executing rsync with attacker-controlled absolute paths via the `--temp-dir` or `--link-dest` options, bypassing path confinement. The requirement for user interaction to supply malicious input prevents this from being a Critical severity issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53795"
},
{
"category": "external",
"summary": "RHBZ#2515389",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515389"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53795"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53795",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53795"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pq",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pq"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-dest",
"url": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-dest"
}
],
"release_date": "2026-08-13T14:39:26.044000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Do not pass untrusted values into --temp-dir or --link-dest. If you need those options, keep the destination (and those dirs) free of writes by untrusted users so a parent cannot be swapped to a symlink. Do not use --partial-dir or --inplace when pulling from an untrusted server. If rsyncd runs with use chroot = no, restrict who can connect.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options"
},
{
"cve": "CVE-2026-53802",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-13T15:13:49.762954+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515416"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by `--files-from` or `--password-file`. This allows the attacker to read arbitrary files accessible to the rsync daemon process, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Arbitrary File Read via Symlink Following",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A symlink-following vulnerability in rsync allows a local, low-privileged attacker to read arbitrary files accessible to the rsync daemon. The issue occurs when rsync improperly handles input configuration files, such as --files-from or --password-file. Exploitation requires a non-default configuration where the attacker can either control the input file paths or plant symlinks within the daemon\u0027s module root.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53802"
},
{
"category": "external",
"summary": "RHBZ#2515416",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515416"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53802",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53802"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53802",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53802"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-following",
"url": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-following"
}
],
"release_date": "2026-08-13T14:32:26.170000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Ensure the rsync daemon runs with the principle of least privilege, enabling use chroot = yes to securely jail the process to its module tree. Restrict write access for daemon configuration directories and files specified by --files-from or --password-file to trusted administrators only. When running rsync outside of daemon mode, ensure users only process input files originating from trusted, non-world-writable directories.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Arbitrary File Read via Symlink Following"
},
{
"cve": "CVE-2026-53803",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-13T15:11:51.112693+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515381"
}
],
"notes": [
{
"category": "description",
"text": "A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges (such as setuid or a privileged daemon), this enables arbitrary file overwrites and local privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Local Privilege Escalation via Symlink Following",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in rsync allows a local attacker to achieve privilege escalation by exploiting a symlink following flaw. In Red Hat environments, the risk is elevated when rsync is configured to run with elevated privileges, such as setuid or in daemon mode, enabling an attacker to overwrite arbitrary files. The requirement for local access and specific privileged configurations prevents a Critical impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53803"
},
{
"category": "external",
"summary": "RHBZ#2515381",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515381"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53803",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53803"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53803",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53803"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-g9f4-7q66-9582",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-g9f4-7q66-9582"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-symlink-following-arbitrary-file-overwrite",
"url": "https://www.vulncheck.com/advisories/rsync-symlink-following-arbitrary-file-overwrite"
}
],
"release_date": "2026-08-13T14:33:18.552000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Do not run rsync setuid or point output paths (--log-file, --write-batch, or daemon config/log files) to user-writable directories like /tmp. While fs.protected_symlinks=1 prevents simple symlink creation in sticky directories on RHEL 7+, it does not stop parent-component attacks in standard directories. If the rsyncd daemon is unneeded, disable it (systemctl disable --now rsyncd); if required, enforce least-privilege execution and restrict network access to trusted hosts.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Local Privilege Escalation via Symlink Following"
},
{
"cve": "CVE-2026-56392",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-07-24T09:01:08.479352+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2506694"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GNU coreutils, specifically in the `unexpand` utility. This vulnerability, a heap-based buffer overflow, occurs due to an integer overflow when `unexpand` processes unusually large tab stop values provided by a local attacker. This can lead to an undersized memory buffer, allowing subsequent operations to write beyond its boundaries. Successful exploitation can cause the `unexpand` utility to crash, potentially resulting in a denial of service or enabling further memory manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A Moderate impact heap-based buffer overflow flaw was found in the `unexpand` utility of GNU coreutils. This vulnerability arises from an integer overflow when processing unusually large tab stop values, leading to an undersized buffer. A local attacker could exploit this by providing crafted input, causing the utility to crash and potentially leading to a denial of service or arbitrary memory manipulation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56392"
},
{
"category": "external",
"summary": "RHBZ#2506694",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506694"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56392",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56392"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56392",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56392"
},
{
"category": "external",
"summary": "https://cert.pl/en/posts/2026/07/CVE-2026-56391",
"url": "https://cert.pl/en/posts/2026/07/CVE-2026-56391"
},
{
"category": "external",
"summary": "https://git.savannah.gnu.org/cgit/coreutils.git/",
"url": "https://git.savannah.gnu.org/cgit/coreutils.git/"
},
{
"category": "external",
"summary": "https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d",
"url": "https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"
}
],
"release_date": "2026-07-24T07:44:54.885000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values"
},
{
"cve": "CVE-2026-63072",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-17T19:24:54.673000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517560"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. A crafted CMS (Cryptographic Message Syntax) message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMS_decrypt(). This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap primitive. This can lead to memory corruption, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: heap buffer overflow in CMS key unwrapping",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to supply a crafted CMS message to be decrypted in an application by CMS_decrypt(). The out-of-bounds write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the memory allocation, causing memory corruption, but the impact is limited to a denial of service. For these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63072"
},
{
"category": "external",
"summary": "RHBZ#2517560",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517560"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63072",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63072"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63072",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63072"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260825.txt",
"url": "https://openssl-library.org/news/secadv/20260825.txt"
}
],
"release_date": "2026-08-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: heap buffer overflow in CMS key unwrapping"
},
{
"cve": "CVE-2026-63076",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-08-17T19:30:30.087000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517561"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. A crafted CMP (Certificate Management Protocol) message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to supply a crafted CMP message to an application acting as a CMP server or client. Server applications need to be configured to accept PBM-protected messages, and client applications need to communicate with a malicious or intercepted CMP server. The missing type check causes an invalid pointer dereference, resulting in a denial of service. There is no memory disclosure, no controlled memory write and no path to code execution. For these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63076"
},
{
"category": "external",
"summary": "RHBZ#2517561",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517561"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63076",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63076"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63076",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63076"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260825.txt",
"url": "https://openssl-library.org/news/secadv/20260825.txt"
}
],
"release_date": "2026-08-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg"
},
{
"cve": "CVE-2026-66046",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2026-08-18T14:21:00.212292+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517901"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts() function, causing excessive CPU consumption and a denial of service",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "expat: Expat: Denial of Service via quadratic complexity in attribute processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An Important severity denial of service vulnerability exists in the Expat library due to inefficient algorithmic complexity when processing XML attributes. Applications parsing untrusted XML are susceptible to remote, unauthenticated attacks where a specially crafted XML payload causes excessive CPU exhaustion, ultimately resulting in service unavailability.\n\nThis vulnerability could affect Firefox and Thunderbird, but the DoS attack impact is limited just to the slowdown of tab which loads affected page. The benefit of such attack is questionable, and there are a lot of different ways to cause similar DoS effect. The CVE-2026-76641 fixes CVE-2026-66046.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66046"
},
{
"category": "external",
"summary": "RHBZ#2517901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66046",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66046"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66046",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66046"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/pull/1321",
"url": "https://github.com/libexpat/libexpat/pull/1321"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity",
"url": "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity"
}
],
"release_date": "2026-08-18T14:10:05.176000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "To mitigate, avoid parsing untrusted XML where possible. Where parsing is required, restrict sources using network controls and enforce strict limits on document size, attribute counts, and request rates at the application or proxy level. Additionally, apply strict execution timeouts to cap parser cost and interrupt processes before they can exhaust CPU resources.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing"
},
{
"cve": "CVE-2026-70452",
"cwe": {
"id": "CWE-636",
"name": "Not Failing Securely (\u0027Failing Open\u0027)"
},
"discovery_date": "2026-08-13T15:12:16.691954+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515386"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. This vulnerability allows a remote attacker to bypass hostname-based access control rules. By inducing DNS resolution failures, the rsync daemon incorrectly skips deny rules, granting unauthorized access to restricted module file trees.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync 3.1.0 \u003c 3.5.0 Access Control Bypass via DNS Resolution Failure",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in rsync allows remote attackers to bypass hostname-based access controls. By inducing DNS resolution failures, an attacker can circumvent `hosts deny` rules, potentially gaining unauthorized access to restricted rsync module file trees on systems configured with hostname-based access controls and exposed to untrusted networks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70452"
},
{
"category": "external",
"summary": "RHBZ#2515386",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515386"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70452"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70452",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70452"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-6692-28cx-wpqq",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-6692-28cx-wpqq"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-access-control-bypass-via-dns-resolution-failure",
"url": "https://www.vulncheck.com/advisories/rsync-access-control-bypass-via-dns-resolution-failure"
}
],
"release_date": "2026-08-13T14:46:50.541000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure rsync to use IP-based access controls instead of hostname-based rules in `rsyncd.conf`. Alternatively, restrict network access to the rsync daemon using firewall rules to allow connections only from trusted IP addresses or networks. This limits exposure by preventing untrusted remote attackers from reaching the service and attempting to induce DNS resolution failures. If changes are made to `rsyncd.conf`, the rsync daemon may need to be restarted or reloaded for the changes to take effect.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync 3.1.0 \u003c 3.5.0 Access Control Bypass via DNS Resolution Failure"
},
{
"cve": "CVE-2026-70453",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-13T15:13:16.902780+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515403"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. A remote attacker can exploit an algorithmic complexity vulnerability within the `hash_search()` function by sending a specially crafted file list. This can lead to the exhaustion of the receiver\u0027s CPU resources, causing a sustained denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Denial of Service via Algorithmic Complexity",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in rsync\u0027s `hash_search()` function allows a remote attacker to cause a denial of service. By sending a specially crafted file list, an attacker can exhaust the receiver\u0027s CPU resources, leading to service unavailability. This is particularly relevant in Red Hat environments where rsync is used for remote file synchronization and may be exposed to untrusted networks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70453"
},
{
"category": "external",
"summary": "RHBZ#2515403",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515403"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70453"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70453",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70453"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-8x5r-mjx8-83hv",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-8x5r-mjx8-83hv"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-algorithmic-complexity-dos-via-hash-search",
"url": "https://www.vulncheck.com/advisories/rsync-algorithmic-complexity-dos-via-hash-search"
}
],
"release_date": "2026-08-13T14:46:20.696000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Disable unused rsyncd services (systemctl disable --now rsyncd), or restrict daemon access to trusted clients via hosts allow and firewall rules. Avoid synchronizing with untrusted senders or pushing to untrusted receivers and upload modules to prevent processing malicious file lists. To contain potential Denial of Service, enforce CPU resource limits on rsync processes using systemd cgroups or ulimit -t to prevent a quadratic search walk from starving the host.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: rsync: Denial of Service via Algorithmic Complexity"
},
{
"cve": "CVE-2026-70454",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-08-13T15:11:36.561905+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515373"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the rsync-ssl wrapper script\u0027s TLS certificate validation. An on-path attacker can present self-signed or invalid certificates to intercept, decrypt, or tamper with encrypted sessions. Because rsync fails to validate the certificate against a trusted CA or verify hostname matching, this interception occurs without detection by the client.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact flaw in rsync allows on-path attackers to intercept and tamper with encrypted sessions. The vulnerability arises from insufficient TLS certificate validation, enabling an attacker to present invalid certificates and compromise data integrity and confidentiality without detection. Exploitation requires an attacker to be positioned to intercept network traffic between the rsync client and server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70454"
},
{
"category": "external",
"summary": "RHBZ#2515373",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515373"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70454"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70454",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70454"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-3c3x-ww2w-5r5p",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-3c3x-ww2w-5r5p"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-tls-certificate-validation-bypass-via-ssl-openssl-mode",
"url": "https://www.vulncheck.com/advisories/rsync-tls-certificate-validation-bypass-via-ssl-openssl-mode"
}
],
"release_date": "2026-08-13T14:45:39.599000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Do not use rsync-ssl with the openssl or stunnel backends. Use rsync over SSH, which authenticates the host and encrypts the session: rsync -avz -e ssh /source user@remote:/destination. If daemon TLS cannot be avoided, restrict those sessions to trusted networks",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions"
},
{
"cve": "CVE-2026-70455",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-13T15:13:42.023564+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515406"
}
],
"notes": [
{
"category": "description",
"text": "A denial-of-service flaw in rsync allows remote attackers to exhaust system memory and CPU. By sending requests using the --zt Zstandard compression alias, an attacker can bypass security directives and spawn an excessive number of worker threads.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Denial of Service via Zstandard compression thread exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important rsync denial-of-service vulnerability allows remote, unauthenticated attackers to exhaust server resources. By using the --zt alias for Zstandard compression, attackers can bypass refuse options to spawn unlimited worker threads and disrupt the service. RHEL 9 and older versions are unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70455"
},
{
"category": "external",
"summary": "RHBZ#2515406",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515406"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70455"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70455",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70455"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjvj-qgqg-cvx9",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjvj-qgqg-cvx9"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-dos-via-zt-zstandard-compression-thread-exhaustion",
"url": "https://www.vulncheck.com/advisories/rsync-dos-via-zt-zstandard-compression-thread-exhaustion"
}
],
"release_date": "2026-08-13T14:45:11.164000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "If the rsync daemon is unused, immediately disable rsyncd.service to eliminate the attack surface. For active deployments, restrict network access (TCP 873) strictly to trusted hosts using firewall rules. Do not rely on refuse options = compress-threads for protection, as the --zt alias bypasses this configuration. Network isolation is the most effective defense.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Denial of Service via Zstandard compression thread exhaustion"
},
{
"cve": "CVE-2026-70456",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-13T15:12:42.109177+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515395"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. A remote attacker could exploit an out-of-bounds write vulnerability in the `read_args()` function by sending a specially crafted argument list. This could lead to corruption of adjacent memory, potentially causing a denial of service or, in some cases, arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Heap Out-of-Bounds Write via crafted argument list",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important severity flaw in rsync, allowing a remote attacker to corrupt heap memory via a specially crafted argument list. The vulnerability, exploitable without authentication or user interaction, could lead to denial of service or potentially arbitrary code execution, elevating its impact beyond Moderate due to the remote, unauthenticated nature of the attack.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70456"
},
{
"category": "external",
"summary": "RHBZ#2515395",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515395"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70456"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70456",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70456"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-78jc-79jv-v6rw",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-78jc-79jv-v6rw"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args",
"url": "https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args"
}
],
"release_date": "2026-08-13T14:44:56.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to rsync services to trusted hosts and networks using firewall rules. If rsync is used in daemon mode, configure `rsyncd.conf` to limit access. When using rsync as a client, avoid synchronizing with untrusted rsync servers.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Heap Out-of-Bounds Write via crafted argument list"
},
{
"cve": "CVE-2026-70457",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-13T15:13:26.653151+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515407"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds write vulnerability in rsync\u0027s parse_size_arg() function allows a remote attacker to cause memory corruption. The flaw is triggered when snprintf() truncates a formatted size string, resulting in an incorrect memory array index. Exploitation can lead to a denial of service and potentially compromise data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Memory corruption via out-of-bounds write in size parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact flaw in rsync stems from an out-of-bounds write in the `parse_size_arg()` function. Although no privileges or user interaction are required, the high attack complexity indicates that exploitation is not straightforward. Successful exploitation could lead to memory corruption, potentially causing a denial of service or compromising data integrity on affected Red Hat systems.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70457"
},
{
"category": "external",
"summary": "RHBZ#2515407",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515407"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70457",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70457"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70457",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70457"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pg7g-xqmr-xpfh",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pg7g-xqmr-xpfh"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-parse-size-arg",
"url": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-parse-size-arg"
}
],
"release_date": "2026-08-13T14:44:30.104000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "If rsync is configured to run as a daemon, restrict network access to trusted hosts using firewall rules. For example, to limit access to localhost:\n`firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" port port=\"873\" protocol=\"tcp\" source address=\"127.0.0.1\" accept\u0027`\n`firewall-cmd --reload`\nThis may impact legitimate remote rsync operations. If rsync is not used as a daemon, ensure that only trusted sources are used for rsync operations.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: rsync: Memory corruption via out-of-bounds write in size parsing"
},
{
"cve": "CVE-2026-70458",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-13T15:11:58.147295+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515379"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. This out-of-bounds write vulnerability allows attackers to corrupt memory by triggering specific processing on specially crafted file entries when hard-link preservation is not active. This can lead to denial of service or other unpredictable system behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Memory corruption via crafted file entries",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important out-of-bounds write vulnerability in rsync can lead to memory corruption when processing specially crafted file entries, potentially resulting in a denial of service. The flaw is triggered when hard-link preservation is inactive, allowing a remote attacker to exploit it without requiring user interaction or elevated privileges.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70458"
},
{
"category": "external",
"summary": "RHBZ#2515379",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515379"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70458"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-gg3m-4m9m-268h",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-gg3m-4m9m-268h"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-flag-hlinked-handling",
"url": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-flag-hlinked-handling"
}
],
"release_date": "2026-08-13T14:44:06.034000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Disable the rsyncd daemon if unused (systemctl disable --now rsyncd), or strictly limit TCP/873 access to trusted clients via firewall rules. For daemons that must remain active, explicitly set refuse options = checksum in rsyncd.conf to block the demonstrated out-of-bounds write vector. Finally, when operating as a client pulling from untrusted peers, always append the --hard-links (-H) flag to force safe memory allocation and prevent corruption.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Memory corruption via crafted file entries"
},
{
"cve": "CVE-2026-70460",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-13T15:11:11.811994+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515368"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal and symlink vulnerability in rsync allows a malicious sender with write access to write files outside the intended directory. By exploiting symbolic links in conjunction with the --partial-dir or --backup-dir options, an attacker can bypass path restrictions to modify arbitrary system files, compromising system integrity",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync 2.3.3 \u003c 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in rsync that allows for path traversal. Exploitation requires a malicious sender to utilize the --partial-dir or --backup-dir options and the ability to create or leverage symlinks within the rsync module\u0027s file tree. This could lead to arbitrary file writes outside the intended module root.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70460"
},
{
"category": "external",
"summary": "RHBZ#2515368",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515368"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70460",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70460"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70460",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70460"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-w3xf-j2r2-gv4x",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-w3xf-j2r2-gv4x"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-path-traversal-via-partial-dir-backup-dir-symlink",
"url": "https://www.vulncheck.com/advisories/rsync-path-traversal-via-partial-dir-backup-dir-symlink"
}
],
"release_date": "2026-08-13T14:43:06.250000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Disable the rsyncd daemon if it is unused (systemctl disable --now rsyncd), or strictly limit TCP/873 access to trusted clients via firewall rules. Within rsyncd.conf, block the exploit vectors directly by setting refuse options = partial-dir backup-dir and maintain defense-in-depth by enforcing use chroot = yes. Finally, ensure no root- or daemon-owned symlinks point outside your module paths, and avoid using the vulnerable flags when operating as a client against untrusted sources.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync 2.3.3 \u003c 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink"
},
{
"cve": "CVE-2026-70461",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-13T15:13:29.709116+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. Remote unauthenticated attackers can exploit a heap out-of-bounds write vulnerability by supplying a crafted files-from entry. This entry, containing both an interior and trailing backslash, causes the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer. This can lead to information disclosure or denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Information disclosure and denial of service via crafted files-from entry",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in rsync that allows remote unauthenticated attackers to achieve information disclosure and denial of service. The flaw occurs in the rsync daemon when processing a specially crafted `files-from` entry, leading to a heap out-of-bounds write. This can be exploited against read-only rsync daemon modules, making it a significant risk for publicly exposed rsync services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70461"
},
{
"category": "external",
"summary": "RHBZ#2515409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70461"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70461",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70461"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-jhxm-j4mq-3fj4",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-jhxm-j4mq-3fj4"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-files-from-entry",
"url": "https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-files-from-entry"
}
],
"release_date": "2026-08-13T14:42:49.726000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Restrict access to the rsync daemon (TCP 873) to trusted hosts with firewall rules. If the daemon is unused, disable and stop rsyncd.service.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Information disclosure and denial of service via crafted files-from entry"
},
{
"cve": "CVE-2026-70463",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"discovery_date": "2026-08-13T15:12:13.215909+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515385"
}
],
"notes": [
{
"category": "description",
"text": "An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain unauthorized access to restricted modules.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Authorization bypass via `auth users` directive parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important authorization bypass in rsync, affecting configurations that utilize the `auth users` directive with group names containing spaces. The flaw allows an authenticated, but unauthorized, user to access restricted rsync modules due to incorrect parsing of deny rules. This bypass occurs because the rsync parser fails to properly tokenize group names with embedded spaces, silently discarding intended access restrictions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70463"
},
{
"category": "external",
"summary": "RHBZ#2515385",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515385"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70463",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70463"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70463",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70463"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pfj8-79vq-xgvr",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pfj8-79vq-xgvr"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-auth-users-directive-parsing",
"url": "https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-auth-users-directive-parsing"
}
],
"release_date": "2026-08-13T14:42:07.126000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "To prevent this authorization bypass, ensure that no group names containing spaces are used within the `auth users` directive in the `rsyncd.conf` configuration file. Review and update any existing configurations to remove spaces from group names in this directive. After making changes, restart the `rsync` service for the new configuration to take effect. For example, use `systemctl restart rsyncd` if managing the service with systemd. Note that restarting the service will temporarily interrupt active rsync operations.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Authorization bypass via `auth users` directive parsing"
},
{
"cve": "CVE-2026-70464",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-13T15:12:01.742340+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515380"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the rsync daemon. An unauthenticated remote attacker can stall the handshake process by opening multiple concurrent connections and trickling data or stalling prior to module selection. This bypasses standard timeouts and exhausts all available connection slots, preventing legitimate clients from connecting.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Denial of Service via handshake stall",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An unauthenticated remote attacker can exhaust available connection slots by stalling the handshake process, preventing legitimate clients from connecting. This vulnerability primarily affects systems where the rsync daemon is explicitly enabled and exposed to untrusted networks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70464"
},
{
"category": "external",
"summary": "RHBZ#2515380",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515380"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70464",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70464"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70464",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70464"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-hrwq-ccf7-rw5m",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-hrwq-ccf7-rw5m"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-connection-slot-exhaustion-dos-via-handshake-stall",
"url": "https://www.vulncheck.com/advisories/rsync-connection-slot-exhaustion-dos-via-handshake-stall"
}
],
"release_date": "2026-08-13T14:41:47.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Disable the rsync daemon if unused (systemctl disable --now rsyncd), or strictly restrict TCP/873 access to trusted clients using firewall rules and hosts allow directives. Do not rely on standard module timeout settings, as they do not protect against this specific pre-handshake stall. While configuring system limits (TasksMax/LimitNOFILE) can prevent full host resource exhaustion, aggressive IP-based connection filtering is the only reliable way to keep the targeted rsync module available.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Denial of Service via handshake stall"
},
{
"cve": "CVE-2026-74860",
"cwe": {
"id": "CWE-763",
"name": "Release of Invalid Pointer or Reference"
},
"discovery_date": "2026-09-08T07:16:42.486000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2529697"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: double-free/UAF in libxml2 Python bindings",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-74860"
},
{
"category": "external",
"summary": "RHBZ#2529697",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529697"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-74860",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74860"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74860",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74860"
}
],
"release_date": "2026-03-08T09:20:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libxml2: double-free/UAF in libxml2 Python bindings"
},
{
"cve": "CVE-2026-75899",
"cwe": {
"id": "CWE-140",
"name": "Improper Neutralization of Delimiters"
},
"discovery_date": "2026-08-24T09:51:05.559475+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2521778"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a loopback address. This vulnerability can lead to Server-Side Request Forgery (SSRF) and bypass host-based security policies.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw in the `fast-uri` library, used by applications for URI parsing, allows for Server-Side Request Forgery (SSRF) and host-policy bypass. By crafting a doubly percent-encoded hostname in an untrusted HTTP-family URI, an attacker could redirect internal application requests to arbitrary network destinations, potentially bypassing security controls and accessing internal services. This risk is present in Red Hat products that process untrusted URIs using affected versions of `fast-uri`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-75899"
},
{
"category": "external",
"summary": "RHBZ#2521778",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521778"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-75899",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75899"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75899",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75899"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf",
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf"
}
],
"release_date": "2026-08-24T09:40:19.801000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding"
},
{
"cve": "CVE-2026-75931",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-08-24T09:51:02.191062+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2521777"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names (IDN) to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an application might validate a URI against a security policy using one hostname, but then resolve to a different, potentially malicious, hostname. This discrepancy could allow an attacker to bypass security policies and access unauthorized resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-uri: fast-uri: Host confusion via skipped IDN canonicalization",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-75931"
},
{
"category": "external",
"summary": "RHBZ#2521777",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521777"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-75931",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75931"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75931",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75931"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8",
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8"
}
],
"release_date": "2026-08-24T09:30:04.212000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "fast-uri: fast-uri: Host confusion via skipped IDN canonicalization"
},
{
"cve": "CVE-2026-84292",
"cwe": {
"id": "CWE-140",
"name": "Improper Neutralization of Delimiters"
},
"discovery_date": "2026-09-02T20:21:15.599288+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2527747"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier (URI) without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker\u0027s host as legitimate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. Applications utilizing the `fast-uri` library in Red Hat environments are susceptible to authority injection if they process untrusted data as the port component of a URI. This could allow an attacker to redirect network traffic to an arbitrary host, compromising communication integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-84292"
},
{
"category": "external",
"summary": "RHBZ#2527747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-84292",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84292"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84292",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84292"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3"
}
],
"release_date": "2026-09-02T20:09:51.415000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization"
},
{
"cve": "CVE-2026-86138",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-09-05T04:31:00.379678+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528986"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the `xmlDictAddQString` function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its integrity and confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate severity heap-based buffer overflow in libxml2, specifically within the `xmlDictAddQString` function, could enable arbitrary code execution. While no user interaction or privileges are required, the high attack complexity and local attack vector reduce the overall risk in Red Hat environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86138"
},
{
"category": "external",
"summary": "RHBZ#2528986",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528986"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86138"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86138",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86138"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4",
"url": "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
}
],
"release_date": "2026-09-05T04:21:53.127000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Bound XML document and QName (prefix + local name) size before intern. Cap process and cgroup memory so a ~4 GiB dictionary pool cannot be built. Keep FORTIFY_SOURCE and heap hardening on Red Hat binaries.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow"
},
{
"cve": "CVE-2026-86140",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-09-05T04:41:05.796692+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528989"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the `xmlSnprintfElements` function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in libxml2 allows a local attacker to achieve arbitrary code execution due to a stack-based buffer overflow. While requiring local access, the vulnerability\u0027s presence in a fundamental system library could lead to significant system compromise if exploited.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86140"
},
{
"category": "external",
"summary": "RHBZ#2528989",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528989"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86140",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86140"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86140",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86140"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340",
"url": "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
}
],
"release_date": "2026-09-05T04:26:13.860000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "To mitigate this, administrators should disable DTD processing and validation for untrusted documents within libxml2 parsers and restrict network access so only authorized users can submit XML data to the application. For robust defense-in-depth against buffer overflow exploitation, ensure the library and dependent applications are compiled with memory safety flags like stack canaries (-fstack-protector-strong) and bounds checking (_FORTIFY_SOURCE=2), while verifying that standard OS-level protections such as ASLR and Data Execution Prevention (NX/XD Bit) are active on the host system.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements"
},
{
"cve": "CVE-2026-86142",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"discovery_date": "2026-09-05T04:41:08.714165+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528990"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in libxml2\u0027s xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer() expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure, data corruption, or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A heap-based buffer overflow in libxml2\u0027s xmlXPtrEvalXPtrPart function enables an out-of-bounds write during the evaluation of oversized xpointer() expressions. The flaw is assigned a Moderate severity rating because exploitation strictly requires local access and complex, multi-gigabyte payload inputs, effectively mitigating the threat of remote or automated system compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86142"
},
{
"category": "external",
"summary": "RHBZ#2528990",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528990"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86142"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86142",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86142"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58",
"url": "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113"
}
],
"release_date": "2026-09-05T04:29:33.323000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "To mitigate this applications should avoid passing untrusted XPointer expressions into xmlXPtrEval or XInclude xpointer= attributes and strictly cap input length well below INT_MAX. Additionally, administrators should enforce process or cgroup memory limits to prevent the construction of multi-gigabyte scheme bodies, relying on heap allocator hardening rather than standard fortify flags, which cannot stop this byte-store loop.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation"
},
{
"cve": "CVE-2026-86143",
"cwe": {
"id": "CWE-192",
"name": "Integer Coercion Error"
},
"discovery_date": "2026-09-05T04:40:59.552825+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528987"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate impact: This flaw in libxml2, a widely used XML parsing library, is due to an integer overflow in write callbacks. This can lead to negative lengths being passed to write operations, potentially causing data integrity issues in applications that process untrusted XML input and utilize affected write callbacks. The impact is limited to applications that specifically trigger this overflow condition.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86143"
},
{
"category": "external",
"summary": "RHBZ#2528987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528987"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86143"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35",
"url": "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111"
}
],
"release_date": "2026-09-05T04:31:21.187000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Cap process and cgroup memory so a process cannot build a \u22652 GiB libxml2 output backlog. Keep FORTIFY_SOURCE-built Red Hat binaries so some callback copies of the truncated length abort instead of corrupting memory",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks"
},
{
"cve": "CVE-2026-86144",
"cwe": {
"id": "CWE-669",
"name": "Incorrect Resource Transfer Between Spheres"
},
"discovery_date": "2026-09-05T04:50:58.626617+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528992"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in libxml2\u0027s XInclude processing (xmlXIncludeProcess and xmlXIncludeProcessTree) fails to propagate parser flags like XML_PARSE_NONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery (SSRF), XML External Entity (XXE) injection, or Denial of Service (DoS) attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A Moderate-severity flaw in libxml2 XInclude processing allows custom resource loaders to bypass network restriction flags, enabling unintended external network connections that could cause SSRF, information disclosure, or Denial of Service (DoS). Exploitation requires local access alongside high attack complexity, limiting its immediate widespread impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86144"
},
{
"category": "external",
"summary": "RHBZ#2528992",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528992"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86144",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86144"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61",
"url": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
}
],
"release_date": "2026-09-05T04:34:43.972000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "Do not expand untrusted XInclude; parse without XML_PARSE_XINCLUDE and do not call xmlXIncludeProcess / xmlXIncludeProcessTree. If XInclude is required, pass XML_PARSE_NONET (and XML_PARSE_NO_XXE where available) via xmlXIncludeProcessFlags, and restrict outbound fetches.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation."
},
{
"cve": "CVE-2026-93749",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-09-22T18:17:34.349880+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2538368"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in source-map-js. This vulnerability allows a remote attacker to trigger a denial of service by providing malformed input. Specifically, by supplying extremely large offset line values in indexed source maps, the attacker can cause the service\u0027s event loop to block, making it unable to process further requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "source-map-js: source-map-js: Denial of Service via malformed indexed source maps",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93749"
},
{
"category": "external",
"summary": "RHBZ#2538368",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538368"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93749",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93749"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93749",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93749"
},
{
"category": "external",
"summary": "https://github.com/7rulnik/source-map-js",
"url": "https://github.com/7rulnik/source-map-js"
},
{
"category": "external",
"summary": "https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118",
"url": "https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118"
},
{
"category": "external",
"summary": "https://github.com/7rulnik/source-map-js/issues/76",
"url": "https://github.com/7rulnik/source-map-js/issues/76"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service",
"url": "https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service"
}
],
"release_date": "2026-09-18T17:51:34.972000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "source-map-js: source-map-js: Denial of Service via malformed indexed source maps"
},
{
"cve": "CVE-2026-93990",
"cwe": {
"id": "CWE-176",
"name": "Improper Handling of Unicode Encoding"
},
"discovery_date": "2026-09-22T21:50:24.320578+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2538967"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Expat. This vulnerability allows a remote attacker to send specially crafted UTF-16 encoded XML data. Due to improper validation of surrogate characters, the parser can be tricked into accepting malformed sequences, which can hide legitimate markup characters. This could enable XML injection attacks, potentially leading to information disclosure or other integrity impacts.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "expat: Expat: XML Injection via Malformed UTF-16 Input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Expat, which can lead to XML injection. The vulnerability arises from improper validation of UTF-16 surrogate pairs, allowing attackers to craft malformed XML that can bypass parser security checks. This could result in data integrity compromise in applications processing untrusted XML input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93990"
},
{
"category": "external",
"summary": "RHBZ#2538967",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538967"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93990"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93990",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93990"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat",
"url": "https://github.com/libexpat/libexpat"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a",
"url": "https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/pull/1282",
"url": "https://github.com/libexpat/libexpat/pull/1282"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate",
"url": "https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate"
}
],
"release_date": "2026-09-19T22:58:11.224000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-08T15:41:00+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:79357"
},
{
"category": "workaround",
"details": "To mitigate this restrict which hosts can send XML (including UTF-16) to Expat-based services with a host firewall and network segmentation. Where applications allow, prefer UTF-8-only input and reject unexpected encodings.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "expat: Expat: XML Injection via Malformed UTF-16 Input"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…