Vulnerability-Lookup

RHSA-2026:87246

Vulnerability from csaf_redhat - Published: 2026-10-21 18:36 - Updated: 2026-10-21 21:34

Summary

Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update

Severity

Important

Notes

Topic: An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336) * crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866) * crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509 (CVE-2025-22874) * net/http: Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673) * crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121) * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143) * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943) Bug Fix(es) and Enhancement(s): * go-toolset:rhel8/golang:Update Go to version 1.25.9+2 [rhel-8.6.z] (JIRA:RHEL-192032) * go-toolset: golang: Update Go to version 1.24.6+1 [rhel-8.6.z] (JIRA:RHEL-235970) * Rebase delve with golang 1.26.1 (JIRA:RHEL-238405) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2024-45336

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to `a.com/` containing an Authorization header redirected to `b.com/` will not send that header to `b.com`. However, the sensitive headers would be restored if the client received a subsequent same-domain redirect. For example, a chain of redirects from `a.com/`, to `b.com/1`, and finally to `b.com/2` would incorrectly send the Authorization header to `b.com/2`.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Fixed 26 products

Product	Version	Remediation
Unresolved product id: AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2025-4673

A flaw was found in net/http. Handling Proxy-Authorization and Proxy-Authenticate headers during cross-origin redirects allows these headers to be inadvertently forwarded, potentially exposing sensitive authentication credentials. This flaw allows a network-based attacker to manipulate redirect responses, unintentionally exposing authentication details to unauthorized parties.

6.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

CWE-201 - Insertion of Sensitive Information Into Sent Data

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Moderate

CVE-2025-22866

A flaw was found in the Golang crypto/internal/nistec package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Considering how this function is used, this leakage is likely insufficient to recover the private key when P-256 is used in any well-known protocols.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Moderate

CVE-2025-22874

A flaw was found in Go's crypto/x509 package. This vulnerability allows improper certificate validation, bypassing policy constraints via using ExtKeyUsageAny in VerifyOptions.KeyUsages.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2025-68121

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Moderate

CVE-2026-27137

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-295 - Improper Certificate Validation

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-27143

A flaw was found in the cmd/compile package in the Go standard library. The compiler fails to correctly check for integer overflow or underflow in arithmetic operations involving loop induction variables. As a result, the compiler allows invalid memory indexing to occur at runtime, potentially leading to memory corruption.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-733 - Compiler Optimization Removal or Modification of Security-critical Code

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Moderate

CVE-2026-27144

A flaw was found in the cmd/compile package in the Go standard library. A no-op interface conversion prevented the compiler from correctly identifying non-overlapping memory moves. As a result, the compiler allows unsafe memory move operations to occur at runtime, potentially causing data corruption, memory corruption or unexpected application behavior.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-440 - Expected Behavior Violation

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Moderate

CVE-2026-27145

A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-606 - Unchecked Input for Loop Condition

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-32280

A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-32281

A flaw was found in Go's `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Moderate

CVE-2026-32282

A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Moderate

CVE-2026-32283

A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-764 - Multiple Locks of a Critical Resource

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-33810

A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L

CWE-1289 - Improper Validation of Unsafe Equivalence in Input

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-33811

A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1341 - Multiple Releases of Same Resource or Handle

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-33814

A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-606 - Unchecked Input for Loop Condition

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-33818

A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-39820

A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-606 - Unchecked Input for Loop Condition

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-39821

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE-1289 - Improper Validation of Unsafe Equivalence in Input

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-42499

A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1046 - Creation of Immutable Text Using String Concatenation

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-42504

A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-56853

A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-56858

A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-56859

A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-56860

A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-56862

A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

CVE-2026-111943

A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.

6.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 26 products, the same list as for CVE-2024-45336

Threats

Impact Important

References

231 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:87246	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2341751	external
https://bugzilla.redhat.com/show_bug.cgi?id=2344219	external
https://bugzilla.redhat.com/show_bug.cgi?id=2372320	external
https://bugzilla.redhat.com/show_bug.cgi?id=2373305	external
https://bugzilla.redhat.com/show_bug.cgi?id=2437111	external
https://bugzilla.redhat.com/show_bug.cgi?id=2445345	external
https://bugzilla.redhat.com/show_bug.cgi?id=2456333	external
https://bugzilla.redhat.com/show_bug.cgi?id=2456335	external
https://bugzilla.redhat.com/show_bug.cgi?id=2456336	external
https://bugzilla.redhat.com/show_bug.cgi?id=2456338	external
https://bugzilla.redhat.com/show_bug.cgi?id=2456339	external
https://bugzilla.redhat.com/show_bug.cgi?id=2456340	external
https://bugzilla.redhat.com/show_bug.cgi?id=2456342	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467809	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467815	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467820	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467822	external
https://bugzilla.redhat.com/show_bug.cgi?id=2480756	external
https://bugzilla.redhat.com/show_bug.cgi?id=2484204	external
https://bugzilla.redhat.com/show_bug.cgi?id=2484207	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515815	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515820	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515827	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515838	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515839	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515840	external
https://bugzilla.redhat.com/show_bug.cgi?id=2556068	external
https://issues.redhat.com/browse/RHEL-192032	external
https://issues.redhat.com/browse/RHEL-235970	external
https://issues.redhat.com/browse/RHEL-238405	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2024-45336	self
https://bugzilla.redhat.com/show_bug.cgi?id=2341751	external
https://www.cve.org/CVERecord?id=CVE-2024-45336	external
https://nvd.nist.gov/vuln/detail/CVE-2024-45336	external
https://github.com/golang/go/issues/70530	external
https://groups.google.com/g/golang-announce/c/sSa…	external
https://access.redhat.com/security/cve/CVE-2025-4673	self
https://bugzilla.redhat.com/show_bug.cgi?id=2373305	external
https://www.cve.org/CVERecord?id=CVE-2025-4673	external
https://nvd.nist.gov/vuln/detail/CVE-2025-4673	external
https://go.dev/cl/679257	external
https://go.dev/issue/73816	external
https://groups.google.com/g/golang-announce/c/ufZ…	external
https://pkg.go.dev/vuln/GO-2025-3751	external
https://access.redhat.com/security/cve/CVE-2025-22866	self
https://bugzilla.redhat.com/show_bug.cgi?id=2344219	external
https://www.cve.org/CVERecord?id=CVE-2025-22866	external
https://nvd.nist.gov/vuln/detail/CVE-2025-22866	external
https://go.dev/cl/643735	external
https://go.dev/issue/71383	external
https://groups.google.com/g/golang-announce/c/xU1…	external
https://pkg.go.dev/vuln/GO-2025-3447	external
https://access.redhat.com/security/cve/CVE-2025-22874	self
https://bugzilla.redhat.com/show_bug.cgi?id=2372320	external
https://www.cve.org/CVERecord?id=CVE-2025-22874	external
https://nvd.nist.gov/vuln/detail/CVE-2025-22874	external
https://go.dev/cl/670375	external
https://go.dev/issue/73612	external
https://pkg.go.dev/vuln/GO-2025-3749	external
https://access.redhat.com/security/cve/CVE-2025-68121	self
https://bugzilla.redhat.com/show_bug.cgi?id=2437111	external
https://www.cve.org/CVERecord?id=CVE-2025-68121	external
https://nvd.nist.gov/vuln/detail/CVE-2025-68121	external
https://go.dev/cl/737700	external
https://go.dev/issue/77217	external
https://groups.google.com/g/golang-announce/c/K09…	external
https://pkg.go.dev/vuln/GO-2026-4337	external
https://access.redhat.com/security/cve/CVE-2026-27137	self
https://bugzilla.redhat.com/show_bug.cgi?id=2445345	external
https://www.cve.org/CVERecord?id=CVE-2026-27137	external
https://nvd.nist.gov/vuln/detail/CVE-2026-27137	external
https://go.dev/cl/752182	external
https://go.dev/issue/77952	external
https://groups.google.com/g/golang-announce/c/Edh…	external
https://pkg.go.dev/vuln/GO-2026-4599	external
https://access.redhat.com/security/cve/CVE-2026-27143	self
https://bugzilla.redhat.com/show_bug.cgi?id=2456342	external
https://www.cve.org/CVERecord?id=CVE-2026-27143	external
https://nvd.nist.gov/vuln/detail/CVE-2026-27143	external
https://go.dev/cl/763765	external
https://go.dev/issue/78333	external
https://groups.google.com/g/golang-announce/c/0uY…	external
https://pkg.go.dev/vuln/GO-2026-4868	external
https://access.redhat.com/security/cve/CVE-2026-27144	self
https://bugzilla.redhat.com/show_bug.cgi?id=2456340	external
https://www.cve.org/CVERecord?id=CVE-2026-27144	external
https://nvd.nist.gov/vuln/detail/CVE-2026-27144	external
https://go.dev/cl/763764	external
https://go.dev/issue/78371	external
https://pkg.go.dev/vuln/GO-2026-4867	external
https://access.redhat.com/security/cve/CVE-2026-27145	self
https://bugzilla.redhat.com/show_bug.cgi?id=2484207	external
https://www.cve.org/CVERecord?id=CVE-2026-27145	external
https://nvd.nist.gov/vuln/detail/CVE-2026-27145	external
https://go.dev/cl/783621	external
https://go.dev/issue/79694	external
https://groups.google.com/g/golang-announce/c/tKs…	external
https://pkg.go.dev/vuln/GO-2026-5037	external
https://access.redhat.com/security/cve/CVE-2026-32280	self
https://bugzilla.redhat.com/show_bug.cgi?id=2456339	external
https://www.cve.org/CVERecord?id=CVE-2026-32280	external
https://nvd.nist.gov/vuln/detail/CVE-2026-32280	external
https://go.dev/cl/758320	external
https://go.dev/issue/78282	external
https://pkg.go.dev/vuln/GO-2026-4947	external
https://access.redhat.com/security/cve/CVE-2026-32281	self
https://bugzilla.redhat.com/show_bug.cgi?id=2456333	external
https://www.cve.org/CVERecord?id=CVE-2026-32281	external
https://nvd.nist.gov/vuln/detail/CVE-2026-32281	external
https://go.dev/cl/758061	external
https://go.dev/issue/78281	external
https://pkg.go.dev/vuln/GO-2026-4946	external
https://access.redhat.com/security/cve/CVE-2026-32282	self
https://bugzilla.redhat.com/show_bug.cgi?id=2456336	external
https://www.cve.org/CVERecord?id=CVE-2026-32282	external
https://nvd.nist.gov/vuln/detail/CVE-2026-32282	external
https://go.dev/cl/763761	external
https://go.dev/issue/78293	external
https://pkg.go.dev/vuln/GO-2026-4864	external
https://access.redhat.com/security/cve/CVE-2026-32283	self
https://bugzilla.redhat.com/show_bug.cgi?id=2456338	external
https://www.cve.org/CVERecord?id=CVE-2026-32283	external
https://nvd.nist.gov/vuln/detail/CVE-2026-32283	external
https://go.dev/cl/763767	external
https://go.dev/issue/78334	external
https://pkg.go.dev/vuln/GO-2026-4870	external
https://access.redhat.com/security/cve/CVE-2026-33810	self
https://bugzilla.redhat.com/show_bug.cgi?id=2456335	external
https://www.cve.org/CVERecord?id=CVE-2026-33810	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33810	external
https://go.dev/cl/763763	external
https://go.dev/issue/78332	external
https://pkg.go.dev/vuln/GO-2026-4866	external
https://access.redhat.com/security/cve/CVE-2026-33811	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467822	external
https://www.cve.org/CVERecord?id=CVE-2026-33811	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33811	external
https://go.dev/cl/767860	external
https://go.dev/issue/78803	external
https://groups.google.com/g/golang-announce/c/qcC…	external
https://pkg.go.dev/vuln/GO-2026-4981	external
https://access.redhat.com/security/cve/CVE-2026-33814	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467815	external
https://www.cve.org/CVERecord?id=CVE-2026-33814	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33814	external
https://go.dev/cl/761581	external
https://go.dev/cl/761640	external
https://go.dev/issue/78476	external
https://pkg.go.dev/vuln/GO-2026-4918	external
https://access.redhat.com/security/cve/CVE-2026-33818	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515815	external
https://www.cve.org/CVERecord?id=CVE-2026-33818	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33818	external
https://go.dev/cl/814980	external
https://go.dev/issue/80405	external
https://groups.google.com/g/golang-announce/c/94p…	external
https://pkg.go.dev/vuln/GO-2026-5972	external
https://access.redhat.com/security/cve/CVE-2026-39820	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467820	external
https://www.cve.org/CVERecord?id=CVE-2026-39820	external
https://nvd.nist.gov/vuln/detail/CVE-2026-39820	external
https://go.dev/cl/759940	external
https://go.dev/issue/78566	external
https://pkg.go.dev/vuln/GO-2026-4986	external
https://access.redhat.com/security/cve/CVE-2026-39821	self
https://bugzilla.redhat.com/show_bug.cgi?id=2480756	external
https://www.cve.org/CVERecord?id=CVE-2026-39821	external
https://nvd.nist.gov/vuln/detail/CVE-2026-39821	external
https://go.dev/cl/767220	external
https://go.dev/issue/78760	external
https://groups.google.com/g/golang-announce/c/iI-…	external
https://pkg.go.dev/vuln/GO-2026-5026	external
https://access.redhat.com/security/cve/CVE-2026-42499	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467809	external
https://www.cve.org/CVERecord?id=CVE-2026-42499	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42499	external
https://go.dev/cl/771520	external
https://go.dev/issue/78987	external
https://pkg.go.dev/vuln/GO-2026-4977	external
https://access.redhat.com/security/cve/CVE-2026-42504	self
https://bugzilla.redhat.com/show_bug.cgi?id=2484204	external
https://www.cve.org/CVERecord?id=CVE-2026-42504	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42504	external
https://go.dev/cl/774481	external
https://go.dev/issue/79217	external
https://pkg.go.dev/vuln/GO-2026-5038	external
https://access.redhat.com/security/cve/CVE-2026-56853	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515827	external
https://www.cve.org/CVERecord?id=CVE-2026-56853	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56853	external
https://go.dev/cl/795540	external
https://go.dev/issue/80205	external
https://pkg.go.dev/vuln/GO-2026-6089	external
https://access.redhat.com/security/cve/CVE-2026-56858	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515838	external
https://www.cve.org/CVERecord?id=CVE-2026-56858	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56858	external
https://go.dev/cl/807100	external
https://go.dev/issue/80435	external
https://pkg.go.dev/vuln/GO-2026-6091	external
https://access.redhat.com/security/cve/CVE-2026-56859	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515840	external
https://www.cve.org/CVERecord?id=CVE-2026-56859	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56859	external
https://go.dev/cl/803320	external
https://go.dev/issue/80481	external
https://pkg.go.dev/vuln/GO-2026-6088	external
https://access.redhat.com/security/cve/CVE-2026-56860	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515820	external
https://www.cve.org/CVERecord?id=CVE-2026-56860	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56860	external
https://go.dev/cl/803681	external
https://go.dev/issue/80494	external
https://pkg.go.dev/vuln/GO-2026-6218	external
https://access.redhat.com/security/cve/CVE-2026-56862	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515839	external
https://www.cve.org/CVERecord?id=CVE-2026-56862	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56862	external
https://go.dev/cl/804261	external
https://go.dev/issue/80528	external
https://pkg.go.dev/vuln/GO-2026-6090	external
https://access.redhat.com/security/cve/CVE-2026-111943	self
https://bugzilla.redhat.com/show_bug.cgi?id=2556068	external
https://access.redhat.com/security/vulnerabilitie…	external
https://www.cve.org/CVERecord?id=CVE-2026-111943	external
https://nvd.nist.gov/vuln/detail/CVE-2026-111943	external
https://github.com/golang/go/issues/82345	external
https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)\n\n* crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)\n\n* crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509 (CVE-2025-22874)\n\n* net/http: Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673)\n\n* crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121)\n\n* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)\n\n* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)\n\n* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\n* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)\n\n* golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144)\n\n* golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143)\n\n* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)\n\n* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)\n\n* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)\n\n* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)\n\n* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)\n\n* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)\n\n* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)\n\n* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n\n* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n\n* net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)\n\n* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)\n\n* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)\n\n* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)\n\n* golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)\n\nBug Fix(es) and Enhancement(s):\n\n* go-toolset:rhel8/golang:Update Go to version 1.25.9+2 [rhel-8.6.z] (JIRA:RHEL-192032)\n\n* go-toolset: golang: Update Go to version 1.24.6+1 [rhel-8.6.z] (JIRA:RHEL-235970)\n\n* Rebase delve with golang 1.26.1 (JIRA:RHEL-238405)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:87246",
        "url": "https://access.redhat.com/errata/RHSA-2026:87246"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2341751",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2341751"
      },
      {
        "category": "external",
        "summary": "2344219",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344219"
      },
      {
        "category": "external",
        "summary": "2372320",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372320"
      },
      {
        "category": "external",
        "summary": "2373305",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373305"
      },
      {
        "category": "external",
        "summary": "2437111",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
      },
      {
        "category": "external",
        "summary": "2445345",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
      },
      {
        "category": "external",
        "summary": "2456333",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
      },
      {
        "category": "external",
        "summary": "2456335",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
      },
      {
        "category": "external",
        "summary": "2456336",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
      },
      {
        "category": "external",
        "summary": "2456338",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
      },
      {
        "category": "external",
        "summary": "2456339",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
      },
      {
        "category": "external",
        "summary": "2456340",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456340"
      },
      {
        "category": "external",
        "summary": "2456342",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456342"
      },
      {
        "category": "external",
        "summary": "2467809",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
      },
      {
        "category": "external",
        "summary": "2467815",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467815"
      },
      {
        "category": "external",
        "summary": "2467820",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
      },
      {
        "category": "external",
        "summary": "2467822",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
      },
      {
        "category": "external",
        "summary": "2480756",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
      },
      {
        "category": "external",
        "summary": "2484204",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
      },
      {
        "category": "external",
        "summary": "2484207",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
      },
      {
        "category": "external",
        "summary": "2515815",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
      },
      {
        "category": "external",
        "summary": "2515820",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
      },
      {
        "category": "external",
        "summary": "2515827",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827"
      },
      {
        "category": "external",
        "summary": "2515838",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838"
      },
      {
        "category": "external",
        "summary": "2515839",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839"
      },
      {
        "category": "external",
        "summary": "2515840",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840"
      },
      {
        "category": "external",
        "summary": "2556068",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556068"
      },
      {
        "category": "external",
        "summary": "RHEL-192032",
        "url": "https://issues.redhat.com/browse/RHEL-192032"
      },
      {
        "category": "external",
        "summary": "RHEL-235970",
        "url": "https://issues.redhat.com/browse/RHEL-235970"
      },
      {
        "category": "external",
        "summary": "RHEL-238405",
        "url": "https://issues.redhat.com/browse/RHEL-238405"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_87246.json"
      }
    ],
    "title": "Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2026-10-21T21:34:12+00:00",
      "generator": {
        "date": "2026-10-21T21:34:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2026:87246",
      "initial_release_date": "2026-10-21T18:36:18+00:00",
      "revision_history": [
        {
          "date": "2026-10-21T18:36:18+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-21T18:36:18+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-21T21:34:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
                  "product_id": "AppStream-8.6.0.Z.AUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_aus:8.6::appstream"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
                  "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
                "product": {
                  "name": "delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src (go-toolset:rhel8)",
                  "product_id": "delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve@1.26.1-1.module%2Bel8.6.0%2B24782%2Ba062e766?arch=src\u0026rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
                "product": {
                  "name": "golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src (go-toolset:rhel8)",
                  "product_id": "golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.10-4.module%2Bel8.6.0%2B25114%2B90ecdb41?arch=src\u0026rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
                "product": {
                  "name": "delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64 (go-toolset:rhel8)",
                  "product_id": "delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve@1.26.1-1.module%2Bel8.6.0%2B24782%2Ba062e766?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
                "product": {
                  "name": "delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64 (go-toolset:rhel8)",
                  "product_id": "delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debugsource@1.26.1-1.module%2Bel8.6.0%2B24782%2Ba062e766?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
                "product": {
                  "name": "delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64 (go-toolset:rhel8)",
                  "product_id": "delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debuginfo@1.26.1-1.module%2Bel8.6.0%2B24782%2Ba062e766?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
                "product": {
                  "name": "golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64 (go-toolset:rhel8)",
                  "product_id": "golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.10-4.module%2Bel8.6.0%2B25114%2B90ecdb41?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
                "product": {
                  "name": "golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64 (go-toolset:rhel8)",
                  "product_id": "golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.26.10-4.module%2Bel8.6.0%2B25114%2B90ecdb41?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
                "product": {
                  "name": "go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64 (go-toolset:rhel8)",
                  "product_id": "go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.26.10-4.module%2Bel8.6.0%2B25114%2B90ecdb41?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
                "product": {
                  "name": "golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64 (go-toolset:rhel8)",
                  "product_id": "golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.26.10-4.module%2Bel8.6.0%2B25114%2B90ecdb41?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
                "product": {
                  "name": "golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch (go-toolset:rhel8)",
                  "product_id": "golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-docs@1.26.10-4.module%2Bel8.6.0%2B25114%2B90ecdb41?arch=noarch\u0026rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
                "product": {
                  "name": "golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch (go-toolset:rhel8)",
                  "product_id": "golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-misc@1.26.10-4.module%2Bel8.6.0%2B25114%2B90ecdb41?arch=noarch\u0026rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
                "product": {
                  "name": "golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch (go-toolset:rhel8)",
                  "product_id": "golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-tests@1.26.10-4.module%2Bel8.6.0%2B25114%2B90ecdb41?arch=noarch\u0026rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
                "product": {
                  "name": "golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch (go-toolset:rhel8)",
                  "product_id": "golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-src@1.26.10-4.module%2Bel8.6.0%2B25114%2B90ecdb41?arch=noarch\u0026rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8"
        },
        "product_reference": "delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8"
        },
        "product_reference": "delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8"
        },
        "product_reference": "delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8"
        },
        "product_reference": "delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8"
        },
        "product_reference": "go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8"
        },
        "product_reference": "golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8"
        },
        "product_reference": "golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8"
        },
        "product_reference": "golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        },
        "product_reference": "golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        },
        "product_reference": "golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8"
        },
        "product_reference": "golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        },
        "product_reference": "golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        },
        "product_reference": "golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8"
        },
        "product_reference": "delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8"
        },
        "product_reference": "delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8"
        },
        "product_reference": "delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8"
        },
        "product_reference": "delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8"
        },
        "product_reference": "go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8"
        },
        "product_reference": "golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8"
        },
        "product_reference": "golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8"
        },
        "product_reference": "golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        },
        "product_reference": "golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        },
        "product_reference": "golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8"
        },
        "product_reference": "golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        },
        "product_reference": "golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        },
        "product_reference": "golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-45336",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2025-01-23T12:57:38.123000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2341751"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to `a.com/` containing an Authorization header redirected to `b.com/` will not send that header to `b.com`. However, the sensitive headers would be restored if the client received a subsequent same-domain redirect. For example, a chain of redirects from `a.com/`, to `b.com/1`, and finally to `b.com/2` would incorrectly send the Authorization header to `b.com/2`.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact: Red Hat products that include the affected golang net/http client are affected by a credential-disclosure flaw in HTTP redirect handling. When a client request with a sensitive header such as Authorization is redirected from one domain to another and then to a same-domain URL, the client can incorrectly restore and send that header to the final destination, potentially exposing credentials and other sensitive information. The current Red Hat scope contains affected entries across Red Hat Enterprise Linux, OpenShift Container Platform, and other Red Hat products and components; some affect records have a current NOTAFFECTED resolution, indicating those specific product/version records are not affected, but the record provides no technical justification for why. For affected entries marked DELEGATED, a fix is being pursued by the responsible product teams. For entries marked DEFER, the record does not establish a product-specific reason for deferral; the residual risk is that applications using the affected net/http client can still disclose sensitive headers through this redirect sequence. Red Hat\u0027s CVSS is 5.9 Moderate (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), compared with CISA\u0027s 6.1 Moderate, reflecting Red Hat\u0027s higher attack-complexity and unchanged-scope assessment and confidentiality-only impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-45336"
        },
        {
          "category": "external",
          "summary": "RHBZ#2341751",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2341751"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-45336",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-45336"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45336",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45336"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/go/issues/70530",
          "url": "https://github.com/golang/go/issues/70530"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/sSaUhLA-2SI",
          "url": "https://groups.google.com/g/golang-announce/c/sSaUhLA-2SI"
        }
      ],
      "release_date": "2025-01-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect"
    },
    {
      "cve": "CVE-2025-4673",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2025-06-18T06:34:57.662025+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2373305"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in net/http. Handling Proxy-Authorization and Proxy-Authenticate headers during cross-origin redirects allows these headers to be inadvertently forwarded, potentially exposing sensitive authentication credentials. This flaw allows a network-based attacker to manipulate redirect responses, unintentionally exposing authentication details to unauthorized parties.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: Sensitive headers not cleared on cross-origin redirect in net/http",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The issue is rated as Moderate because while it can lead to a significant compromise of confidentiality, the attack complexity is high. Successful exploitation requires a specific set of circumstances, including the use of a proxy that relies on these headers for authentication and a user being enticed to interact with a malicious URL. The vulnerability does not allow for arbitrary code execution or a direct compromise of system integrity or availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-4673"
        },
        {
          "category": "external",
          "summary": "RHBZ#2373305",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373305"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-4673",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-4673"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-4673",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4673"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/679257",
          "url": "https://go.dev/cl/679257"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/73816",
          "url": "https://go.dev/issue/73816"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A",
          "url": "https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-3751",
          "url": "https://pkg.go.dev/vuln/GO-2025-3751"
        }
      ],
      "release_date": "2025-06-11T16:42:53.054000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: Sensitive headers not cleared on cross-origin redirect in net/http"
    },
    {
      "cve": "CVE-2025-22866",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2025-02-06T17:00:56.155646+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2344219"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Golang crypto/internal/nistec package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Considering how this function is used, this leakage is likely insufficient to recover the private key when P-256 is used in any well-known protocols.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact: Red Hat product builds using the Golang crypto/internal/nistec component on ppc64le are exposed to a timing side channel. A variable-time instruction in an internal assembly function leaks a small number of bits of secret scalars; given how the function is used, the leakage is likely insufficient to recover a private key when P-256 is used in well-known protocols. The current affects cover Red Hat Enterprise Linux, OpenShift Container Platform, and other Red Hat products, while entries resolved as Not a Bug, Obsolete, or delegated NOTAFFECTED are outside the actionable affected scope. For the DEFER entries, remediation is deferred because the leakage is not believed sufficient for private-key recovery in those protocols; the residual risk is limited scalar-bit leakage on ppc64le. For DELEGATED entries, the same Moderate impact is being handled by the relevant product teams, with a fix being pursued. Red Hat\u0027s CVSS is 5.3 Moderate with a network attack vector, compared with CISA\u0027s 4.0 Moderate local-vector assessment.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-22866"
        },
        {
          "category": "external",
          "summary": "RHBZ#2344219",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344219"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-22866",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-22866"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-22866",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22866"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/643735",
          "url": "https://go.dev/cl/643735"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/71383",
          "url": "https://go.dev/issue/71383"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k",
          "url": "https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-3447",
          "url": "https://pkg.go.dev/vuln/GO-2025-3447"
        }
      ],
      "release_date": "2025-02-06T16:54:10.252000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec"
    },
    {
      "cve": "CVE-2025-22874",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2025-06-11T17:00:48.521459+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2372320"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s crypto/x509 package. This vulnerability allows improper certificate validation, bypassing policy constraints via using ExtKeyUsageAny in VerifyOptions.KeyUsages.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated as an Important severity because the vulnerability was found in the certificate validation logic of the Verify function. When VerifyOptions.KeyUsages includes ExtKeyUsageAny, certificate chains containing policy graphs may bypass certificate policy validation. This flaw allows an attacker to trick the system into accepting an invalid certificate, potentially enabling spoofing attacks, the issue weakens trust decisions in affected cases and impacts system integrity. Confidentiality and availability are not affected.\n\nRed Hat Openshift Container Platform openshift-golang-builder-container ships golang 1.23 and does not ship the affected code.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-22874"
        },
        {
          "category": "external",
          "summary": "RHBZ#2372320",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372320"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-22874",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-22874"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-22874",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22874"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/670375",
          "url": "https://go.dev/cl/670375"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/73612",
          "url": "https://go.dev/issue/73612"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A",
          "url": "https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-3749",
          "url": "https://pkg.go.dev/vuln/GO-2025-3749"
        }
      ],
      "release_date": "2025-06-11T16:42:52.856000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509"
    },
    {
      "cve": "CVE-2025-68121",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-02-05T18:01:30.086058+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2437111"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "RHBZ#2437111",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/737700",
          "url": "https://go.dev/cl/737700"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77217",
          "url": "https://go.dev/issue/77217"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
          "url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4337",
          "url": "https://pkg.go.dev/vuln/GO-2026-4337"
        }
      ],
      "release_date": "2026-02-05T17:48:44.141000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "cve": "CVE-2026-27137",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-03-06T22:01:38.859733+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445345"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27137"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445345",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/752182",
          "url": "https://go.dev/cl/752182"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77952",
          "url": "https://go.dev/issue/77952"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4599",
          "url": "https://pkg.go.dev/vuln/GO-2026-4599"
        }
      ],
      "release_date": "2026-03-06T21:28:13.748000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
    },
    {
      "cve": "CVE-2026-27143",
      "cwe": {
        "id": "CWE-733",
        "name": "Compiler Optimization Removal or Modification of Security-critical Code"
      },
      "discovery_date": "2026-04-08T02:01:29.491546+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456342"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the cmd/compile package in the Go standard library. The compiler fails to correctly check for integer overflow or underflow in arithmetic operations involving loop induction variables. As a result, the compiler allows invalid memory indexing to occur at runtime, potentially leading to memory corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: cmd/compile: possible memory corruption after bound check elimination",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is only exploitable in applications that contain a loop structure that relies on an induction variable. An induction variable is a variable that gets modified, usually incremented or decremented, by a predictable amount on each iteration. Inside the loop, the induction variable must be directly used as the index to access or modify elements within an array or a slice. Additionally, an attacker must be able to cause an integer overflow or underflow in the induction variable to trigger this issue. Due to these reasons, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27143"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456342",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456342"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27143",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27143"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27143",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27143"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763765",
          "url": "https://go.dev/cl/763765"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78333",
          "url": "https://go.dev/issue/78333"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4868",
          "url": "https://pkg.go.dev/vuln/GO-2026-4868"
        }
      ],
      "release_date": "2026-04-08T01:06:57.168000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, strictly sanitize and enforce bounds checking on any untrusted user input that influences loop counters, iteration limits, or memory indices. If there is no integer overflow or underflow, the out-of-bounds access cannot occur.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: cmd/compile: possible memory corruption after bound check elimination"
    },
    {
      "cve": "CVE-2026-27144",
      "cwe": {
        "id": "CWE-440",
        "name": "Expected Behavior Violation"
      },
      "discovery_date": "2026-04-08T02:01:22.896153+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456340"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the cmd/compile package in the Go standard library. A no-op interface conversion prevented the compiler from correctly identifying non-overlapping memory moves. As a result, the compiler allows unsafe memory move operations to occur at runtime, potentially causing data corruption, memory corruption or unexpected application behavior.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: cmd/compile: no-op interface conversion bypasses overlap checking",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is only exploitable in applications that contain a memory move or copy operation that is subject to a no-op (no-operation) interface conversion. Furthermore, the source and destination memory addresses involved in the move or copy must overlap and an attacker must be able to supply an input that triggers this specific operation. Due to these reasons, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27144"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456340",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456340"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27144",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27144"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27144",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27144"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763764",
          "url": "https://go.dev/cl/763764"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78371",
          "url": "https://go.dev/issue/78371"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4867",
          "url": "https://pkg.go.dev/vuln/GO-2026-4867"
        }
      ],
      "release_date": "2026-04-08T01:06:56.908000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, review code that performs memory copies or struct assignments. If data is being passed through an interface (such as \u0027any\u0027 or \u0027interface{}\u0027) just before a move operation, refactor the code to use concrete types or explicit pointers instead.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: cmd/compile: no-op interface conversion bypasses overlap checking"
    },
    {
      "cve": "CVE-2026-27145",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-06-02T23:01:08.992540+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484207"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484207",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27145",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/783621",
          "url": "https://go.dev/cl/783621"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79694",
          "url": "https://go.dev/issue/79694"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5037",
          "url": "https://pkg.go.dev/vuln/GO-2026-5037"
        }
      ],
      "release_date": "2026-06-02T22:01:36.954000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "cve": "CVE-2026-32280",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-08T02:01:19.572351+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456339"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the Go standard library\u0027s certificate chain building process. Systems utilizing Go applications that process untrusted TLS certificates or X.509 certificate chains are susceptible to resource exhaustion when presented with an excessive number of intermediate certificates, potentially leading to service unavailability. This flaw impacts applications directly using `crypto/x509` or `crypto/tls`.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456339",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/758320",
          "url": "https://go.dev/cl/758320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78282",
          "url": "https://go.dev/issue/78282"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4947",
          "url": "https://pkg.go.dev/vuln/GO-2026-4947"
        }
      ],
      "release_date": "2026-04-08T01:06:58.595000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "cve": "CVE-2026-32281",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-04-08T02:01:00.930989+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456333"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw occurs during the validation of otherwise trusted certificate chains that contain a large number of policy mappings, leading to excessive resource consumption. Exploitation requires an attacker to present a specially crafted, yet trusted, certificate chain which would require the attacker has already compromised a trusted certificate root. Red Hat continuously monitors certificate authorities and curates the set which is trusted by default for Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32281"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456333",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32281",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/758061",
          "url": "https://go.dev/cl/758061"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78281",
          "url": "https://go.dev/issue/78281"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4946",
          "url": "https://pkg.go.dev/vuln/GO-2026-4946"
        }
      ],
      "release_date": "2026-04-08T01:06:58.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "cve": "CVE-2026-32282",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-04-08T02:01:12.683211+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456336"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32282"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456336",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763761",
          "url": "https://go.dev/cl/763761"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78293",
          "url": "https://go.dev/issue/78293"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4864",
          "url": "https://pkg.go.dev/vuln/GO-2026-4864"
        }
      ],
      "release_date": "2026-04-08T01:06:55.953000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
    },
    {
      "cve": "CVE-2026-32283",
      "cwe": {
        "id": "CWE-764",
        "name": "Multiple Locks of a Critical Resource"
      },
      "discovery_date": "2026-04-08T02:01:16.213799+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456338"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: A flaw in the Go `crypto/tls` package allows a remote attacker to cause a denial of service in applications using TLS 1.3. By sending multiple key update messages in a single record post-handshake, an attacker can trigger a connection deadlock, leading to uncontrolled resource consumption. This impacts Red Hat products utilizing the affected Go standard library for TLS 1.3 connections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32283"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456338",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763767",
          "url": "https://go.dev/cl/763767"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78334",
          "url": "https://go.dev/issue/78334"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4870",
          "url": "https://pkg.go.dev/vuln/GO-2026-4870"
        }
      ],
      "release_date": "2026-04-08T01:06:57.670000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "cve": "CVE-2026-33810",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-04-08T02:01:09.100830+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456335"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in the Go `crypto/x509` package that could allow an attacker to bypass certificate validation. The vulnerability arises from an incorrect application of excluded DNS constraints to wildcard DNS Subject Alternative Names (SANs) when their case differs from the constraint. This could lead to Red Hat products accepting malicious certificates from otherwise trusted chains, compromising the trust model.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33810"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456335",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33810",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33810"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763763",
          "url": "https://go.dev/cl/763763"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78332",
          "url": "https://go.dev/issue/78332"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4866",
          "url": "https://pkg.go.dev/vuln/GO-2026-4866"
        }
      ],
      "release_date": "2026-04-08T01:06:56.546000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application"
    },
    {
      "cve": "CVE-2026-33811",
      "cwe": {
        "id": "CWE-1341",
        "name": "Multiple Releases of Same Resource or Handle"
      },
      "discovery_date": "2026-05-07T20:01:34.913869+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33811"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/767860",
          "url": "https://go.dev/cl/767860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78803",
          "url": "https://go.dev/issue/78803"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4981",
          "url": "https://pkg.go.dev/vuln/GO-2026-4981"
        }
      ],
      "release_date": "2026-05-07T19:41:19.285000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "cve": "CVE-2026-33814",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-05-07T20:01:11.324941+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service flaw in the Go HTTP/2 protocol implementation allows a remote, unauthenticated attacker to exhaust system resources. By sending a specially crafted HTTP/2 SETTINGS frame with a zero-value SETTINGS_MAX_FRAME_SIZE, the vulnerable Go library enters an infinite loop, impacting the availability of services utilizing HTTP/2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33814"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33814",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33814"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33814",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33814"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/761581",
          "url": "https://go.dev/cl/761581"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/761640",
          "url": "https://go.dev/cl/761640"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78476",
          "url": "https://go.dev/issue/78476"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4918",
          "url": "https://pkg.go.dev/vuln/GO-2026-4918"
        }
      ],
      "release_date": "2026-05-07T19:41:17.631000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "cve": "CVE-2026-33818",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:12:37.151735+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/814980",
          "url": "https://go.dev/cl/814980"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80405",
          "url": "https://go.dev/issue/80405"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5972",
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "release_date": "2026-08-13T21:58:52.821000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "cve": "CVE-2026-39820",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-05-07T20:01:27.800929+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39820"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/759940",
          "url": "https://go.dev/cl/759940"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78566",
          "url": "https://go.dev/issue/78566"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4986",
          "url": "https://pkg.go.dev/vuln/GO-2026-4986"
        }
      ],
      "release_date": "2026-05-07T19:41:19.854000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "cve": "CVE-2026-39821",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-05-22T16:00:52.844126+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480756"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480756",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/767220",
          "url": "https://go.dev/cl/767220"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78760",
          "url": "https://go.dev/issue/78760"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5026",
          "url": "https://pkg.go.dev/vuln/GO-2026-5026"
        }
      ],
      "release_date": "2026-05-22T15:01:21.462000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "cve": "CVE-2026-42499",
      "cwe": {
        "id": "CWE-1046",
        "name": "Creation of Immutable Text Using String Concatenation"
      },
      "discovery_date": "2026-05-07T20:00:51.685602+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467809"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42499"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467809",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/771520",
          "url": "https://go.dev/cl/771520"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78987",
          "url": "https://go.dev/issue/78987"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4977",
          "url": "https://pkg.go.dev/vuln/GO-2026-4977"
        }
      ],
      "release_date": "2026-05-07T19:41:18.615000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "cve": "CVE-2026-42504",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-06-02T23:01:00.320527+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484204"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484204",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42504",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/774481",
          "url": "https://go.dev/cl/774481"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79217",
          "url": "https://go.dev/issue/79217"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5038",
          "url": "https://pkg.go.dev/vuln/GO-2026-5038"
        }
      ],
      "release_date": "2026-06-02T22:01:37.219000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "cve": "CVE-2026-56853",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:14:53.561638+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: Unencrypted HTTP/2 servers are susceptible to a denial of service due to improper handling of ReadHeaderTimeout during the client preface reading phase. This can lead to resource exhaustion and service unavailability in affected Red Hat products configured to support unencrypted HTTP/2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56853",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/795540",
          "url": "https://go.dev/cl/795540"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80205",
          "url": "https://go.dev/issue/80205"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6089",
          "url": "https://pkg.go.dev/vuln/GO-2026-6089"
        }
      ],
      "release_date": "2026-08-13T21:58:53.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "cve": "CVE-2026-56858",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:32.034590+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515838"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash (\u0027/\u0027), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user\u0027s browser, potentially compromising user data or actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important cross-site scripting (XSS) vulnerability in the Go `html/template` package. Applications utilizing this package to render untrusted input are susceptible to arbitrary content injection due to a flaw in how pathological inputs are handled, potentially leading to client-side script execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515838",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/807100",
          "url": "https://go.dev/cl/807100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80435",
          "url": "https://go.dev/issue/80435"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6091",
          "url": "https://pkg.go.dev/vuln/GO-2026-6091"
        }
      ],
      "release_date": "2026-08-13T21:58:53.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "cve": "CVE-2026-56859",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:52.493058+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515840"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important denial of service flaw affects applications utilizing the Go `encoding/xml` package. This vulnerability arises from an issue in XML decoding where a recursion depth counter fails to reset, potentially leading to stack exhaustion when processing malicious XML input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515840",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56859",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803320",
          "url": "https://go.dev/cl/803320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80481",
          "url": "https://go.dev/issue/80481"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6088",
          "url": "https://pkg.go.dev/vuln/GO-2026-6088"
        }
      ],
      "release_date": "2026-08-13T21:58:52.959000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "cve": "CVE-2026-56860",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:13:18.319384+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory (\u0027..\u0027) segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments (\u0027..\u0027) may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803681",
          "url": "https://go.dev/cl/803681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80494",
          "url": "https://go.dev/issue/80494"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6218",
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "release_date": "2026-08-13T21:58:53.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "cve": "CVE-2026-56862",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-08-13T22:16:41.928450+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515839"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `golang` `crypto/tls` package. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515839",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/804261",
          "url": "https://go.dev/cl/804261"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80528",
          "url": "https://go.dev/issue/80528"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6090",
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "release_date": "2026-08-13T21:58:53.216000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "cve": "CVE-2026-111943",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-20T09:38:36.160000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556068"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important because Go applications validating TLS certificates could accept unauthorized certificates issued by distrusted intermediate Certificate Authorities, potentially compromising the integrity and confidentiality of secure network communications. Any Go-based client or server relying on standard certificate verification may be exposed to man-in-the-middle attacks if an attacker intercepts traffic using certificates derived from these intermediate keys. Exploitation requires specific network positioning and certificates generated by the untrusted intermediate authorities, limiting opportunistic widespread abuse.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
          "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556068",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556068"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-012",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-111943",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111943",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/go/issues/82345",
          "url": "https://github.com/golang/go/issues/82345"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU",
          "url": "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU"
        }
      ],
      "release_date": "2026-10-20T02:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T18:36:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:87246"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.AUS:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debuginfo-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:delve-debugsource-0:1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:go-toolset-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-bin-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-docs-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-misc-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-race-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-src-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8",
            "AppStream-8.6.0.Z.EUS.EXTENSION:golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch::go-toolset:rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates"
    }
  ]
}

CVE-2024-45336 (GCVE-0-2024-45336)

Vulnerability from cvelistv5 – Published: 2025-01-28 01:03 – Updated: 2025-09-18 18:41

Title

Sensitive headers incorrectly sent after cross-domain redirect in net/http

Summary

The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-01-28 14:56 UTC

CWE

CWE-201 - Insertion of Sensitive Information Into Sent Data

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

6 references

URL	Tags
https://go.dev/cl/643100
https://go.dev/issue/70530
https://groups.google.com/g/golang-dev/c/CAWXhan3…
https://groups.google.com/g/golang-dev/c/bG8cv1mu…
https://pkg.go.dev/vuln/GO-2025-3420
https://security.netapp.com/advisory/ntap-2025022…

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/http	Affected: 0 , < 1.22.11 (semver) Affected: 1.23.0-0 , < 1.23.5 (semver) Affected: 1.24.0-0 , < 1.24.0-rc.2 (semver)

Credits

Kyle Seely

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-45336",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-28T14:56:59.058895Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-28T15:16:38.044Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-02-21T18:03:31.299Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250221-0003/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "Client.do"
            },
            {
              "name": "Client.makeHeadersCopier"
            },
            {
              "name": "shouldCopyHeaderOnRedirect"
            },
            {
              "name": "Client.Do"
            },
            {
              "name": "Client.Get"
            },
            {
              "name": "Client.Head"
            },
            {
              "name": "Client.Post"
            },
            {
              "name": "Client.PostForm"
            },
            {
              "name": "Get"
            },
            {
              "name": "Head"
            },
            {
              "name": "Post"
            },
            {
              "name": "PostForm"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.22.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.23.5",
              "status": "affected",
              "version": "1.23.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.24.0-rc.2",
              "status": "affected",
              "version": "1.24.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Kyle Seely"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-18T18:41:11.116Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/643100"
        },
        {
          "url": "https://go.dev/issue/70530"
        },
        {
          "url": "https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ"
        },
        {
          "url": "https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2025-3420"
        }
      ],
      "title": "Sensitive headers incorrectly sent after cross-domain redirect in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-45336",
    "datePublished": "2025-01-28T01:03:24.869Z",
    "dateReserved": "2024-08-27T19:41:58.555Z",
    "dateUpdated": "2025-09-18T18:41:11.116Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-22866 (GCVE-0-2025-22866)

Vulnerability from cvelistv5 – Published: 2025-02-06 16:54 – Updated: 2025-02-21 18:03

Title

Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

Summary

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.

Severity

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-10 20:40 UTC

CWE

CWE-208 - Observable Timing Discrepancy

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

5 references

URL	Tags
https://go.dev/cl/643735
https://go.dev/issue/71383
https://groups.google.com/g/golang-announce/c/xU1…
https://pkg.go.dev/vuln/GO-2025-3447
https://security.netapp.com/advisory/ntap-2025022…

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/internal/nistec	Affected: 0 , < 1.22.12 (semver) Affected: 1.23.0-0 , < 1.23.6 (semver) Affected: 1.24.0-0 , < 1.24.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22866",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-10T20:40:17.232803Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T14:47:25.778Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-02-21T18:03:36.215Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250221-0002/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/internal/nistec",
          "product": "crypto/internal/nistec",
          "programRoutines": [
            {
              "name": "p256NegCond"
            },
            {
              "name": "P256Point.ScalarBaseMult"
            },
            {
              "name": "P256Point.ScalarMult"
            },
            {
              "name": "P256Point.SetBytes"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.22.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.23.6",
              "status": "affected",
              "version": "1.23.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.24.0-rc.3",
              "status": "affected",
              "version": "1.24.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-208: Observable Timing Discrepancy",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-06T16:54:10.252Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/643735"
        },
        {
          "url": "https://go.dev/issue/71383"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2025-3447"
        }
      ],
      "title": "Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-22866",
    "datePublished": "2025-02-06T16:54:10.252Z",
    "dateReserved": "2025-01-08T19:11:42.834Z",
    "dateUpdated": "2025-02-21T18:03:36.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-22874 (GCVE-0-2025-22874)

Vulnerability from cvelistv5 – Published: 2025-06-11 16:42 – Updated: 2025-06-16 20:26

Title

Usage of ExtKeyUsageAny disables policy validation in crypto/x509

Summary

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-11 17:45 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/cl/670375
https://go.dev/issue/73612
https://groups.google.com/g/golang-announce/c/ufZ…
https://pkg.go.dev/vuln/GO-2025-3749

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/x509	Affected: 1.24.0-0 , < 1.24.4 (semver)

Credits

Krzysztof Skrzętnicki (@Tener) of Teleport

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22874",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-11T17:45:40.672701Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-11T17:46:34.625Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/x509",
          "product": "crypto/x509",
          "programRoutines": [
            {
              "name": "Certificate.Verify"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.24.4",
              "status": "affected",
              "version": "1.24.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Krzysztof Skrz\u0119tnicki (@Tener) of Teleport"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-16T20:26:53.242Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/670375"
        },
        {
          "url": "https://go.dev/issue/73612"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2025-3749"
        }
      ],
      "title": "Usage of ExtKeyUsageAny disables policy validation in crypto/x509"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-22874",
    "datePublished": "2025-06-11T16:42:52.856Z",
    "dateReserved": "2025-01-08T19:11:42.835Z",
    "dateUpdated": "2025-06-16T20:26:53.242Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-4673 (GCVE-0-2025-4673)

Vulnerability from cvelistv5 – Published: 2025-06-11 16:42 – Updated: 2025-06-11 17:59

Title

Sensitive headers not cleared on cross-origin redirect in net/http

Summary

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-11 17:59 UTC

CWE

CWE-201 - Insertion of Sensitive Information Into Sent Data

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/cl/679257
https://go.dev/issue/73816
https://groups.google.com/g/golang-announce/c/ufZ…
https://pkg.go.dev/vuln/GO-2025-3751

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/http	Affected: 0 , < 1.23.10 (semver) Affected: 1.24.0-0 , < 1.24.4 (semver)

Credits

Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-4673",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-11T17:59:02.225500Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-11T17:59:48.033Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "Client.makeHeadersCopier"
            },
            {
              "name": "Client.Do"
            },
            {
              "name": "Client.Get"
            },
            {
              "name": "Client.Head"
            },
            {
              "name": "Client.Post"
            },
            {
              "name": "Client.PostForm"
            },
            {
              "name": "Get"
            },
            {
              "name": "Head"
            },
            {
              "name": "Post"
            },
            {
              "name": "PostForm"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.23.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.24.4",
              "status": "affected",
              "version": "1.24.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-11T16:42:53.054Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/679257"
        },
        {
          "url": "https://go.dev/issue/73816"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2025-3751"
        }
      ],
      "title": "Sensitive headers not cleared on cross-origin redirect in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-4673",
    "datePublished": "2025-06-11T16:42:53.054Z",
    "dateReserved": "2025-05-13T23:30:53.327Z",
    "dateUpdated": "2025-06-11T17:59:48.033Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-68121 (GCVE-0-2025-68121)

Vulnerability from cvelistv5 – Published: 2026-02-05 17:48 – Updated: 2026-04-29 13:29

Title

Unexpected session resumption in crypto/tls

Summary

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-29 03:55 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

4 references

URL	Tags
https://groups.google.com/g/golang-announce/c/K09…
https://go.dev/cl/737700
https://go.dev/issue/77217
https://pkg.go.dev/vuln/GO-2026-4337

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/tls	Affected: 0 , < 1.24.13 (semver) Affected: 1.25.0-0 , < 1.25.7 (semver) Affected: 1.26.0-rc.1 , < 1.26.0-rc.3 (semver)

Credits

Coia Prant (github.com/rbqvq) Go Security Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-68121",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-29T03:55:46.305385Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-295",
                "description": "CWE-295 Improper Certificate Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-29T13:29:25.582Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/tls",
          "product": "crypto/tls",
          "programRoutines": [
            {
              "name": "Conn.handshakeContext"
            },
            {
              "name": "Conn.Handshake"
            },
            {
              "name": "Conn.HandshakeContext"
            },
            {
              "name": "Conn.Read"
            },
            {
              "name": "Conn.Write"
            },
            {
              "name": "Dial"
            },
            {
              "name": "DialWithDialer"
            },
            {
              "name": "Dialer.Dial"
            },
            {
              "name": "Dialer.DialContext"
            },
            {
              "name": "QUICConn.Start"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.24.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.25.7",
              "status": "affected",
              "version": "1.25.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.0-rc.3",
              "status": "affected",
              "version": "1.26.0-rc.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Coia Prant (github.com/rbqvq)"
        },
        {
          "lang": "en",
          "value": "Go Security Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-05T17:48:44.141Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
        },
        {
          "url": "https://go.dev/cl/737700"
        },
        {
          "url": "https://go.dev/issue/77217"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4337"
        }
      ],
      "title": "Unexpected session resumption in crypto/tls"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-68121",
    "datePublished": "2026-02-05T17:48:44.141Z",
    "dateReserved": "2025-12-15T16:48:04.451Z",
    "dateUpdated": "2026-04-29T13:29:25.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111943 (GCVE-0-2026-111943)

Vulnerability from cvelistv5 – Published: 2026-10-21 00:52 – Updated: 2026-10-21 01:24

Title

Distrust compromised intermediate certificates in crypto/x509

Summary

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.

Severity

No CVSS data available.

CWE

CWE-299 - Improper Check for Certificate Revocation

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

5 references

URL	Tags
https://go.dev/cl/851047
https://go.dev/issue/82345
https://groups.google.com/g/golang-announce/c/66p…
https://pkg.go.dev/vuln/GO-2026-6809
http://www.openwall.com/lists/oss-security/2026/1…

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/x509	Affected: 0 , < 1.26.10 (semver) Affected: 1.27.0-0 , < 1.27.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-21T01:24:20.498Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/20/29"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/x509",
          "product": "crypto/x509",
          "programRoutines": [
            {
              "name": "Certificate.Verify"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.26.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-299: Improper Check for Certificate Revocation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:52:18.359Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/851047"
        },
        {
          "url": "https://go.dev/issue/82345"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/66pojueaQek"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6809"
        }
      ],
      "title": "Distrust compromised intermediate certificates in crypto/x509"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-111943",
    "datePublished": "2026-10-21T00:52:18.359Z",
    "dateReserved": "2026-10-17T13:43:28.599Z",
    "dateUpdated": "2026-10-21T01:24:20.498Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27137 (GCVE-0-2026-27137)

Vulnerability from cvelistv5 – Published: 2026-03-06 21:28 – Updated: 2026-09-18 12:04

Title

Incorrect enforcement of email constraints in crypto/x509

Summary

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-10 13:32 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

67 references

URL	Tags
https://go.dev/cl/752182
https://go.dev/issue/77952
https://groups.google.com/g/golang-announce/c/Edh…
https://pkg.go.dev/vuln/GO-2026-4599
https://access.redhat.com/security/cve/CVE-2026-27137	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2445345	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:41019	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54757	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36796	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28047	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39810	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49703	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49702	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:67517	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56143	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10929	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8842	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10169	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19022	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22937	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19049	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22450	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19132	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61253	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:67160	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57649	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:67159	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49712	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:67518	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56223	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28038	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19181	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23228	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22714	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:5549	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9872	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22862	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11800	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26585	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22423	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22347	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23345	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29854	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26568	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8151	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13545	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7291	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9052	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41928	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10184	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10158	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10175	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9697	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9698	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9699	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9385	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19375	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14879	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10125	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10250	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10225	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8338	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8337	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8167	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:5110	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21769	vendor-advisoryx_refsource_REDHAT

Impacted products

121 products

Vendor	Product	Version
Go standard library	crypto/x509	Affected: 1.26.0-0 , < 1.26.1 (semver)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.2.3-4.el10_1 , < * (rpm) Unaffected: 0:0.2.7-3.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1 cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:1.25.2-3.el10_1 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:1.26.2-2.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.9.27-6.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:165.1-2.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:52.1-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:0.2.3-4.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:1.26.5-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:1.26.1-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:5.3.0-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:10.2.6-26.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.26.2-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:165.1-2.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:52.1-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:1.26.5-1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.1.1-5.el9_2.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:1.26.5-1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.1.1-9.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 6:0.8.5-2.el9_6.2 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:1.26.5-1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.1.1-15.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:10.2.6-23.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat OpenStack Platform 16.2	Unaffected: 0:0.2.1-1.1.el8ost , < * (rpm) cpe:/a:redhat:openstack:16.2::el8
Red Hat	Red Hat OpenStack Platform 16.2	Unaffected: 0:3.3.23-22.el8ost , < * (rpm) cpe:/a:redhat:openstack:16.2::el8
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:3.4.26-9.5.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Services on OpenShift 18.0	Unaffected: 0:0.1.1-18.0.20260602234716.a95ae05.el9ost , < * (rpm) cpe:/a:redhat:openstack:18.0::el9
Red Hat	RHEM 1.0 for RHEL 9	Unaffected: 0:1.0.3-1.el9em , < * (rpm) cpe:/a:redhat:edge_manager:1.0::el9
Red Hat	RHEM 1.1 for RHEL 10	Unaffected: 0:1.1.3-1.el10em , < * (rpm) cpe:/a:redhat:edge_manager:1.1::el10
Red Hat	RHEM 1.1 for RHEL 9	Unaffected: 0:1.1.3-1.el9em , < * (rpm) cpe:/a:redhat:edge_manager:1.1::el9
Red Hat	Builds for Red Hat OpenShift 1.6.0	Unaffected: 1774334066 , < * (rpm) cpe:/a:redhat:openshift_builds:1.6::el9
Red Hat	DevWorkspace Operator 0.4	Unaffected: 1776457293 , < * (rpm) cpe:/a:redhat:devworkspace:0.40::el9
Red Hat	Logging for Red Hat OpenShift 6	Unaffected: 1781192891 , < * (rpm) cpe:/a:redhat:logging:6.0::el9
Red Hat	Logging for Red Hat OpenShift 6.2	Unaffected: 1776800087 , < * (rpm) cpe:/a:redhat:logging:6.2::el9
Red Hat	Logging Subsystem for Red Hat OpenShift 6.4	Unaffected: 1780051640 , < * (rpm) cpe:/a:redhat:logging:6.4::el9
Red Hat	Multicluster Global Hub 1.3.4	Unaffected: 1779210675 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.3::el9
Red Hat	Multicluster Global Hub 1.4.5	Unaffected: 1779838819 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.4::el9
Red Hat	Multicluster Global Hub 1.6.5	Unaffected: 1780320809 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.6::el9
Red Hat	OpenShift API for Data Protection 1.4	Unaffected: 1779809598 , < * (rpm) cpe:/a:redhat:openshift_api_data_protection:1.4::el9
Red Hat	OpenShift API for Data Protection 1.5	Unaffected: 1779808027 , < * (rpm) cpe:/a:redhat:openshift_api_data_protection:1.5::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.15	Unaffected: 1774085848 , < * (rpm) cpe:/a:redhat:acm:2.15::el9
Red Hat	Red Hat Ansible Automation Platform 2.6	Unaffected: 1777391542 , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.6::el9
Red Hat	Red Hat Hardened Images	Unaffected: 1.26.2-1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Lightspeed (formerly Insights) for Runtimes 1.0	Unaffected: 1.0.2-1776288486 , < * (rpm) cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9
Red Hat	Red Hat Migration Toolkit 1.8	Unaffected: 1783914276 , < * (rpm) cpe:/a:redhat:rhmt:1.8::el8
Red Hat	Red Hat multicluster global hub 1.5.3	Unaffected: 1773650627 , < * (rpm) Unaffected: 1779828691 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.5::el9
Red Hat	Red Hat OpenShift AI 2.25	Unaffected: 1776773362 , < * (rpm) cpe:/a:redhat:openshift_ai:2.25::el9
Red Hat	Red Hat OpenShift Builds 1.7.3	Unaffected: 1776846936 , < * (rpm) cpe:/a:redhat:openshift_builds:1.7::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.27	Unaffected: 1776789889 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.27::el9
Red Hat	Red Hat OpenShift distributed tracing 3.9.3	Unaffected: 1776435680 , < * (rpm) cpe:/a:redhat:openshift_distributed_tracing:3.9::el9
Red Hat	Red Hat OpenShift GitOps 1.18	Unaffected: 1776755965 , < * (rpm) cpe:/a:redhat:openshift_gitops:1.18::el8
Red Hat	Red Hat OpenShift GitOps 1.19	Unaffected: 1776767162 , < * (rpm) cpe:/a:redhat:openshift_gitops:1.19::el8
Red Hat	Red Hat OpenShift GitOps 1.20	Unaffected: 1776773421 , < * (rpm) cpe:/a:redhat:openshift_gitops:1.20::el9
Red Hat	Red Hat Quay 3.16	Unaffected: 1779204086 , < * (rpm) cpe:/a:redhat:quay:3.16::el9
Red Hat	Red Hat Satellite 6.18	Unaffected: 1778082595 , < * (rpm) cpe:/a:redhat:satellite:6.18::el9
Red Hat	Red Hat Trusted Artifact Signer 1.3	Unaffected: 1776339099 , < * (rpm) cpe:/a:redhat:trusted_artifact_signer:1.3::el9
Red Hat	Red Hat Web Terminal 1.11	Unaffected: 1776966691 , < * (rpm) cpe:/a:redhat:webterminal:1.11::el9
Red Hat	Red Hat Web Terminal 1.12	Unaffected: 1776959849 , < * (rpm) cpe:/a:redhat:webterminal:1.12::el9
Red Hat	Red Hat Web Terminal 1.13	Unaffected: 1776197785 , < * (rpm) cpe:/a:redhat:webterminal:1.13::el9
Red Hat	Red Hat Web Terminal 1.14	Unaffected: 1776199398 , < * (rpm) cpe:/a:redhat:webterminal:1.14::el9
Red Hat	Red Hat Web Terminal 1.15	Unaffected: 1775672762 , < * (rpm) cpe:/a:redhat:webterminal:1.15::el9
Red Hat	Assisted Installer for Red Hat OpenShift Container Platform 2	cpe:/a:redhat:assisted_installer:2
Red Hat	cert-manager Operator for Red Hat OpenShift	cpe:/a:redhat:cert_manager:1
Red Hat	Compliance Operator	cpe:/a:redhat:openshift_compliance_operator:1
Red Hat	Confidential Compute Attestation	cpe:/a:redhat:confidential_compute_attestation:1
Red Hat	Cryostat 4	cpe:/a:redhat:cryostat:4
Red Hat	Custom Metric Autoscaler operator for Red Hat Openshift	cpe:/a:redhat:openshift_custom_metrics_autoscaler:2
Red Hat	Deployment Validation Operator	cpe:/a:redhat:deployment_validator_operator
Red Hat	ExternalDNS Operator	cpe:/a:redhat:ext_dns_optr:1
Red Hat	External Secrets Operator for Red Hat OpenShift	cpe:/a:redhat:external_secrets_operator:1
Red Hat	Fence Agents Remediation Operator	cpe:/a:redhat:workload_availability_far:0
Red Hat	File Integrity Operator	cpe:/a:redhat:openshift_file_integrity_operator:1
Red Hat	Gatekeeper 3	cpe:/a:redhat:gatekeeper:3
Red Hat	Logging Subsystem for Red Hat OpenShift	cpe:/a:redhat:logging:5
Red Hat	Logical Volume Manager Storage	cpe:/a:redhat:lvms:4
Red Hat	Machine Deletion Remediation Operator	cpe:/a:redhat:workload_availability_mdr:0
Red Hat	Migration Toolkit for Applications 8	cpe:/a:redhat:migration_toolkit_applications:8
Red Hat	mirror registry for Red Hat OpenShift	cpe:/a:redhat:mirror_registry:1
Red Hat	mirror registry for Red Hat OpenShift 2	cpe:/a:redhat:mirror_registry:2
Red Hat	Multicluster Engine for Kubernetes	cpe:/a:redhat:multicluster_engine
Red Hat	Network Observability Operator	cpe:/a:redhat:network_observ_optr:1
Red Hat	Node HealthCheck Operator	cpe:/a:redhat:workload_availability_nhc:0
Red Hat	OpenShift Developer Tools and Services	cpe:/a:redhat:ocp_tools
Red Hat	OpenShift Lightspeed	cpe:/a:redhat:openshift_lightspeed
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	OpenShift Serverless	cpe:/a:redhat:serverless:1
Red Hat	OpenShift Service Mesh 2	cpe:/a:redhat:service_mesh:2
Red Hat	OpenShift Service Mesh 3	cpe:/a:redhat:service_mesh:3
Red Hat	Power monitoring for Red Hat OpenShift	cpe:/a:redhat:openshift_power_monitoring
Red Hat	Red Hat 3scale API Management Platform 2	cpe:/a:redhat:red_hat_3scale_amp:2
Red Hat	Red Hat Advanced Cluster Security 4	cpe:/a:redhat:advanced_cluster_security:4
Red Hat	Red Hat Ansible Automation Platform 2	cpe:/a:redhat:ansible_automation_platform:2
Red Hat	Red Hat build of Apache Camel - HawtIO 4	cpe:/a:redhat:apache_camel_hawtio:4
Red Hat	Red Hat Certification Program for Red Hat Enterprise Linux 9	cpe:/a:redhat:certifications:9
Red Hat	Red Hat Connectivity Link 1	cpe:/a:redhat:connectivity_link:1
Red Hat	Red Hat Developer Hub	cpe:/a:redhat:rhdh:1
Red Hat	Red Hat Edge Manager 1	cpe:/a:redhat:edge_manager:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	cpe:/a:redhat:enterprise_linux_ai:3
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift Cluster Manager CLI	cpe:/a:redhat:openshift_cluster_manager_cli:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat Openshift Data Foundation 4	cpe:/a:redhat:openshift_data_foundation:4
Red Hat	Red Hat OpenShift for Windows Containers	cpe:/a:redhat:windows_machine_config
Red Hat	Red Hat OpenShift on AWS	cpe:/a:redhat:openshift_service_on_aws:1
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenStack Platform 16.2	cpe:/a:redhat:openstack:16.2
Red Hat	Red Hat OpenStack Platform 17.1	cpe:/a:redhat:openstack:17.1
Red Hat	Red Hat OpenStack Platform 18.0	cpe:/a:redhat:openstack:18.0
Red Hat	Red Hat Quay 3	cpe:/a:redhat:quay:3
Red Hat	Red Hat Satellite 6	cpe:/a:redhat:satellite:6
Red Hat	Red Hat Service Interconnect 1	cpe:/a:redhat:service_interconnect:1
Red Hat	Red Hat Service Interconnect 2	cpe:/a:redhat:service_interconnect:2
Red Hat	Security Profiles Operator	cpe:/a:redhat:openshift_security_profiles_operator:1
Red Hat	Service Telemetry Framework 1.5	cpe:/a:redhat:stf:1.5
Red Hat	streams for Apache Kafka 3	cpe:/a:redhat:amq_streams:3
Red Hat	Zero Trust Workload Identity Manager	cpe:/a:redhat:zero_trust_workload_identity_manager:1
Red Hat	Zero Trust Workload Identity Manager - Tech Preview	cpe:/a:redhat:zero_trust_workload_identity_manager:0

Credits

Jakub Ciolek

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-27137",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-10T13:32:09.097820Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-10T13:32:53.202Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1",
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc-worker-playbook",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.2.3-4.el10_1",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.2.7-3.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1"
            ],
            "defaultStatus": "affected",
            "packageName": "delve",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.25.2-3.el10_1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.2-2.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang-github-openprinting-ipp-usb",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.9.27-6.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:165.1-2.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "image-builder",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:52.1-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc-worker-playbook",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.2.3-4.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "delve",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.1-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana-pcp",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.3.0-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:10.2.6-26.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.2-1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:165.1-2.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "image-builder",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:52.1-1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana-pcp",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.1.1-5.el9_2.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana-pcp",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.1.1-9.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "gvisor-tap-vsock",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "6:0.8.5-2.el9_6.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana-pcp",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.1.1-15.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:10.2.6-23.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "collectd-sensubility",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.2.1-1.1.el8ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "etcd",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.3.23-22.el8ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "etcd",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.4.26-9.5.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "golang-github-openstack-k8s-operators-os-diff",
            "product": "Red Hat OpenStack Services on OpenShift 18.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.1.1-18.0.20260602234716.a95ae05.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "flightctl",
            "product": "RHEM 1.0 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.0.3-1.el9em",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.1::el10"
            ],
            "defaultStatus": "affected",
            "packageName": "flightctl",
            "product": "RHEM 1.1 for RHEL 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.1.3-1.el10em",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "flightctl",
            "product": "RHEM 1.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.1.3-1.el9em",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_builds:1.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-builds/openshift-builds-waiters-rhel9",
            "product": "Builds for Red Hat OpenShift 1.6.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1774334066",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:devworkspace:0.40::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devworkspace/devworkspace-rhel9-operator",
            "product": "DevWorkspace Operator 0.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776457293",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:logging:6.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-logging/eventrouter-rhel9",
            "product": "Logging for Red Hat OpenShift 6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1781192891",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:logging:6.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-logging/eventrouter-rhel9",
            "product": "Logging for Red Hat OpenShift 6.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776800087",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:logging:6.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-logging/eventrouter-rhel9",
            "product": "Logging Subsystem for Red Hat OpenShift 6.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780051640",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
            "product": "Multicluster Global Hub 1.3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779210675",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
            "product": "Multicluster Global Hub 1.4.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779838819",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
            "product": "Multicluster Global Hub 1.6.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780320809",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "oadp/oadp-velero-rhel9",
            "product": "OpenShift API for Data Protection 1.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779809598",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "oadp/oadp-velero-rhel9",
            "product": "OpenShift API for Data Protection 1.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779808027",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/subctl-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1774085848",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform-26/receptor-rhel9",
            "product": "Red Hat Ansible Automation Platform 2.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777391542",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "golang1-26-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.26.2-1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator",
            "product": "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.0.2-1776288486",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhmt:1.8::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhmtc/openshift-migration-registry-rhel8",
            "product": "Red Hat Migration Toolkit 1.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783914276",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
            "product": "Red Hat multicluster global hub 1.5.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1773650627",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779828691",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-rhel9-operator",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776773362",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_builds:1.7::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-builds/openshift-builds-waiters-rhel9",
            "product": "Red Hat OpenShift Builds 1.7.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776846936",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.27::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/udi-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.27",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776789889",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosdt/tempo-rhel9",
            "product": "Red Hat OpenShift distributed tracing 3.9.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776435680",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_gitops:1.18::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-gitops-1/dex-rhel8",
            "product": "Red Hat OpenShift GitOps 1.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776755965",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_gitops:1.19::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-gitops-1/dex-rhel8",
            "product": "Red Hat OpenShift GitOps 1.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776767162",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_gitops:1.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-gitops-1/dex-rhel9",
            "product": "Red Hat OpenShift GitOps 1.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776773421",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel9",
            "product": "Red Hat Quay 3.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779204086",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:satellite:6.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "satellite/iop-vmaas-rhel9",
            "product": "Red Hat Satellite 6.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778082595",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhtas/client-server-rhel9",
            "product": "Red Hat Trusted Artifact Signer 1.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776339099",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776966691",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.12::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776959849",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776197785",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776199398",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1775672762",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:assisted_installer:2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhai/assisted-installer-rhel9",
            "product": "Assisted Installer for Red Hat OpenShift Container Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cert_manager:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "cert-manager/jetstack-cert-manager-rhel9",
            "product": "cert-manager Operator for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_compliance_operator:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "compliance/openshift-compliance-operator-bundle",
            "product": "Compliance Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:confidential_compute_attestation:1"
            ],
            "defaultStatus": "affected",
            "packageName": "build-of-trustee/trustee-rhel9-operator",
            "product": "Confidential Compute Attestation",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:confidential_compute_attestation:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-sandboxed-containers/osc-monitor-rhel9",
            "product": "Confidential Compute Attestation",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "cryostat/cryostat-storage-rhel9",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9",
            "product": "Custom Metric Autoscaler operator for Red Hat Openshift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:deployment_validator_operator"
            ],
            "defaultStatus": "affected",
            "packageName": "dvo/deployment-validation-rhel8-operator",
            "product": "Deployment Validation Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ext_dns_optr:1"
            ],
            "defaultStatus": "affected",
            "packageName": "edo/external-dns-rhel8",
            "product": "ExternalDNS Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ext_dns_optr:1"
            ],
            "defaultStatus": "affected",
            "packageName": "edo/external-dns-rhel9",
            "product": "ExternalDNS Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:external_secrets_operator:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "external-secrets-operator/external-secrets-rhel9",
            "product": "External Secrets Operator for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_far:0"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/fence-agents-remediation-rhel8-operator",
            "product": "Fence Agents Remediation Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_file_integrity_operator:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "compliance/openshift-compliance-operator-bundle",
            "product": "File Integrity Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:gatekeeper:3"
            ],
            "defaultStatus": "affected",
            "packageName": "gatekeeper/gatekeeper-rhel9-operator",
            "product": "Gatekeeper 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:logging:5"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-logging/eventrouter-rhel9",
            "product": "Logging Subsystem for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:logging:5"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-logging/logging-loki-rhel9",
            "product": "Logging Subsystem for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lvms:4"
            ],
            "defaultStatus": "affected",
            "packageName": "lvms4/lvms-rhel9-operator",
            "product": "Logical Volume Manager Storage",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lvms:4"
            ],
            "defaultStatus": "affected",
            "packageName": "lvms4/topolvm-rhel8",
            "product": "Logical Volume Manager Storage",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lvms:4"
            ],
            "defaultStatus": "affected",
            "packageName": "lvms4/topolvm-rhel9",
            "product": "Logical Volume Manager Storage",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_mdr:0"
            ],
            "defaultStatus": "unaffected",
            "packageName": "workload-availability/machine-deletion-remediation-rhel8-operator",
            "product": "Machine Deletion Remediation Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:migration_toolkit_applications:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "mta/mta-cli-rhel9",
            "product": "Migration Toolkit for Applications 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:mirror_registry:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/mirror-registry-rhel8",
            "product": "mirror registry for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:mirror_registry:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift/mirror-registry-rhel8",
            "product": "mirror registry for Red Hat OpenShift 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "unaffected",
            "packageName": "multicluster-engine/discovery-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:network_observ_optr:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "network-observability/network-observability-cli-rhel9",
            "product": "Network Observability Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0"
            ],
            "defaultStatus": "unaffected",
            "packageName": "workload-availability/node-healthcheck-rhel8-operator",
            "product": "Node HealthCheck Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools"
            ],
            "defaultStatus": "affected",
            "packageName": "helm",
            "product": "OpenShift Developer Tools and Services",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools"
            ],
            "defaultStatus": "affected",
            "packageName": "ocp-tools-4/jenkins-agent-base-rhel9",
            "product": "OpenShift Developer Tools and Services",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools"
            ],
            "defaultStatus": "affected",
            "packageName": "ocp-tools-4/jenkins-rhel8",
            "product": "OpenShift Developer Tools and Services",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_lightspeed"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-lightspeed/lightspeed-rhel9-operator",
            "product": "OpenShift Lightspeed",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines-client",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kn-workflow-plugin",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-plugin-event-sender-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-clients",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-golang-builder-container",
            "product": "OpenShift Service Mesh 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-service-mesh/kiali-rhel8",
            "product": "OpenShift Service Mesh 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-golang-builder-container",
            "product": "OpenShift Service Mesh 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-service-mesh/kiali-rhel9",
            "product": "OpenShift Service Mesh 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_power_monitoring"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-power-monitoring/kepler-rhel9",
            "product": "Power monitoring for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_3scale_amp:2"
            ],
            "defaultStatus": "affected",
            "packageName": "3scale-amp2/3scale-rhel7-operator",
            "product": "Red Hat 3scale API Management Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_3scale_amp:2"
            ],
            "defaultStatus": "affected",
            "packageName": "3scale-amp2/3scale-rhel9-operator",
            "product": "Red Hat 3scale API Management Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_3scale_amp:2"
            ],
            "defaultStatus": "affected",
            "packageName": "3scale-amp26/3scale-operator",
            "product": "Red Hat 3scale API Management Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_3scale_amp:2"
            ],
            "defaultStatus": "affected",
            "packageName": "3scale-amp26/operator",
            "product": "Red Hat 3scale API Management Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "advanced-cluster-security/rhacs-main-rhel8",
            "product": "Red Hat Advanced Cluster Security 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ansible-automation-platform/platform-operator-bundle",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "automation-gateway-proxy",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "automation-gateway-proxy-openssl30",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "automation-gateway-proxy-openssl32",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python3.11-galaxy-ng",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python3.11-grpcio",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python3.12-galaxy-ng",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python3.12-grpcio",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python3x-grpcio",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python-grpcio",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "receptor",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_hawtio:4"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbac-4/hawtio-rhel9-operator",
            "product": "Red Hat build of Apache Camel - HawtIO 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:certifications:9"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-certification-preflight",
            "product": "Red Hat Certification Program for Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:connectivity_link:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcl-1/coredns-rhel9",
            "product": "Red Hat Connectivity Link 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-rhel9-operator",
            "product": "Red Hat Developer Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhem/flightctl-ui-rhel9",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "buildah",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "butane",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "conmon",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "git-lfs",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "go-fdo-client",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "go-fdo-server",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana-pcp",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "gvisor-tap-vsock",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "ignition",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "podman",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "rhel10/bootc-image-builder",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "skopeo",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "toolbox",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "trustee",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "trustee-guest-components",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "yggdrasil",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "host-metering",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhc-worker-script",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/buildah",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "container-tools:rhel8/conmon",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "container-tools:rhel8/containernetworking-plugins",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/podman",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/runc",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/skopeo",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/toolbox",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "git-lfs",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "go-toolset:rhel8/golang",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana-pcp",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "weldr-client",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "buildah",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "butane",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "conmon",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "containernetworking-plugins",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "git-lfs",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana-pcp",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "gvisor-tap-vsock",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "ignition",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "podman",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhel9/bootc-image-builder",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "runc",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "skopeo",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "toolbox",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "trustee-guest-components",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "weldr-client",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-cli-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-rhel8-operator",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_cluster_manager_cli:1"
            ],
            "defaultStatus": "affected",
            "packageName": "ocm-cli-clients/ocm-cli-rhel9",
            "product": "Red Hat OpenShift Cluster Manager CLI",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "butane",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "conmon",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "conmon-rs",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "containernetworking-plugins",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-tools",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "golang-github-prometheus-promu",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ignition",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "kata-containers",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "microshift",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/frr-rhel8",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/frr-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-sdn-rhel8",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-clients",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-golang-builder-container",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-kuryr",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ose-aws-ecr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ose-azure-acr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ose-gcp-gcr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "podman",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "runc",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "skopeo",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:windows_machine_config"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator",
            "product": "Red Hat OpenShift for Windows Containers",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_service_on_aws:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rosa",
            "product": "Red Hat OpenShift on AWS",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-native-virtualization/virt-api",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-native-virtualization/virt-api-rhel9",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kubevirt",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-golang-builder-container",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang-github-infrawatch-apputils",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosp-rhel8/osp-director-agent",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "collectd-libpod-stats",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "golang-github-infrawatch-apputils",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosp-rhel9/osp-director-agent",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoso-operators/sg-core-rhel9",
            "product": "Red Hat OpenStack Platform 18.0",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quay:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "quay/quay-builder-rhel8",
            "product": "Red Hat Quay 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quay:3"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "satellite:el8/yggdrasil-worker-forwarder",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "affected",
            "packageName": "yggdrasil-worker-forwarder",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_interconnect:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "skupper-cli",
            "product": "Red Hat Service Interconnect 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_interconnect:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "skupper-cli",
            "product": "Red Hat Service Interconnect 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_security_profiles_operator:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "compliance/openshift-selinuxd-rhel8",
            "product": "Security Profiles Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:stf:1.5"
            ],
            "defaultStatus": "unaffected",
            "packageName": "stf/sg-core-rhel9",
            "product": "Service Telemetry Framework 1.5",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3"
            ],
            "defaultStatus": "affected",
            "packageName": "golang-github-danielqsj-kafka_exporter",
            "product": "streams for Apache Kafka 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "zero-trust-workload-identity-manager/spiffe-csi-driver-rhel9",
            "product": "Zero Trust Workload Identity Manager",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
            ],
            "defaultStatus": "affected",
            "packageName": "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9",
            "product": "Zero Trust Workload Identity Manager - Tech Preview",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-03-06T21:28:13.748Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-295",
                "description": "Improper Certificate Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T12:04:42.431Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-27137"
          },
          {
            "name": "RHBZ#2445345",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27137.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41019"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54757"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36796"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28047"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39810"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49703"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49702"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67517"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56143"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10929"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8842"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10169"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19022"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22937"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19049"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22450"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19132"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61253"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67160"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57649"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67159"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49712"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67518"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56223"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28038"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19181"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23228"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22714"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:5549"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9872"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22862"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:11800"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26585"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22423"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22347"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23345"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29854"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26568"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8151"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13545"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7291"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9052"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41928"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10184"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10158"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10175"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9697"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9698"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9699"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9385"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19375"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14879"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10125"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10250"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10225"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8338"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8337"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8167"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:5110"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21769"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:41019: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54757: Red Hat OpenStack Platform 16.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36796: RHEM 1.0 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28047: Red Hat OpenStack Platform 17.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39810: 9Base-RHOSO-TOOLS-18, Red Hat OpenStack Services on OpenShift 18.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49703: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49702: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:67517: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56143: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10929: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8842: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10169: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19022: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22937: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19049: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22450: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19132: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:61253: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:67160: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57649: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:67159: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49712: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:67518: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56223: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28038: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19181: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23228: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22714: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:5549: Builds for Red Hat OpenShift 1.6.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9872: DevWorkspace Operator 0.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22862: Logging Subsystem for Red Hat OpenShift 6.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:11800: Logging for Red Hat OpenShift 6.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26585: Logging for Red Hat OpenShift 6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22423: Multicluster Global Hub 1.3.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22347: Multicluster Global Hub 1.4.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23345: Multicluster Global Hub 1.6.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29854: OpenShift API for Data Protection 1.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26568: OpenShift API for Data Protection 1.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8151: Red Hat Advanced Cluster Management for Kubernetes 2.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13545: Red Hat Ansible Automation Platform 2.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7291: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9052: Red Hat Lightspeed (formerly Insights) for Runtimes 1.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41928: Red Hat Migration Toolkit 1.8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10184: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10158: Red Hat OpenShift Builds 1.7.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10175: Red Hat OpenShift Dev Spaces 3.27"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9697: Red Hat OpenShift GitOps 1.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9698: Red Hat OpenShift GitOps 1.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9699: Red Hat OpenShift GitOps 1.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9385: Red Hat OpenShift distributed tracing 3.9.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19375: Red Hat Quay 3.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14879: Red Hat Satellite 6.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10125: Red Hat Trusted Artifact Signer 1.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10250: Red Hat Web Terminal 1.11"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10225: Red Hat Web Terminal 1.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8338: Red Hat Web Terminal 1.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8337: Red Hat Web Terminal 1.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8167: Red Hat Web Terminal 1.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:5110: Red Hat multicluster global hub 1.5.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21769: Red Hat multicluster global hub 1.5.3"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-03-06T22:01:38.859Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-03-06T21:28:13.748Z",
            "value": "Made public."
          }
        ],
        "title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/x509",
          "product": "crypto/x509",
          "programRoutines": [
            {
              "name": "newEmailConstraints"
            },
            {
              "name": "emailConstraints.query"
            },
            {
              "name": "checkConstraints"
            },
            {
              "name": "checkChainConstraints"
            },
            {
              "name": "parseMailboxes"
            },
            {
              "name": "Certificate.Verify"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.26.1",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jakub Ciolek"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-08T05:56:20.771Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/752182"
        },
        {
          "url": "https://go.dev/issue/77952"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4599"
        }
      ],
      "title": "Incorrect enforcement of email constraints in crypto/x509"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-27137",
    "datePublished": "2026-03-06T21:28:13.748Z",
    "dateReserved": "2026-02-17T19:57:28.434Z",
    "dateUpdated": "2026-09-18T12:04:42.431Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27143 (GCVE-0-2026-27143)

Vulnerability from cvelistv5 – Published: 2026-04-08 01:06 – Updated: 2026-04-13 18:20

Title

Missing bound checks can lead to memory corruption in safe Go in cmd/compile

Summary

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-13 17:50 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/cl/763765
https://go.dev/issue/78333
https://groups.google.com/g/golang-announce/c/0uY…
https://pkg.go.dev/vuln/GO-2026-4868

Impacted products

1 product

Vendor	Product	Version
Go toolchain	cmd/compile	Affected: 0 , < 1.25.9 (semver) Affected: 1.26.0-0 , < 1.26.2 (semver)

Credits

Jakub Ciolek - https://ciolek.dev/

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-27143",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-13T17:50:24.131708Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-13T18:20:17.933Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "cmd/compile",
          "product": "cmd/compile",
          "vendor": "Go toolchain",
          "versions": [
            {
              "lessThan": "1.25.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.2",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jakub Ciolek - https://ciolek.dev/"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T01:06:57.168Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/763765"
        },
        {
          "url": "https://go.dev/issue/78333"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4868"
        }
      ],
      "title": "Missing bound checks can lead to memory corruption in safe Go in cmd/compile"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-27143",
    "datePublished": "2026-04-08T01:06:57.168Z",
    "dateReserved": "2026-02-17T19:57:28.435Z",
    "dateUpdated": "2026-04-13T18:20:17.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27144 (GCVE-0-2026-27144)

Vulnerability from cvelistv5 – Published: 2026-04-08 01:06 – Updated: 2026-04-13 18:20

Title

Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile

Summary

The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-13 17:49 UTC

CWE

CWE-440 - Expected Behavior Violation

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/cl/763764
https://go.dev/issue/78371
https://groups.google.com/g/golang-announce/c/0uY…
https://pkg.go.dev/vuln/GO-2026-4867

Impacted products

1 product

Vendor	Product	Version
Go toolchain	cmd/compile	Affected: 0 , < 1.25.9 (semver) Affected: 1.26.0-0 , < 1.26.2 (semver)

Credits

Jakub Ciolek - https://ciolek.dev/

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-27144",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-13T17:49:47.300247Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-13T18:20:28.098Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "cmd/compile",
          "product": "cmd/compile",
          "vendor": "Go toolchain",
          "versions": [
            {
              "lessThan": "1.25.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.2",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jakub Ciolek - https://ciolek.dev/"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-440: Expected Behavior Violation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T01:06:56.908Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/763764"
        },
        {
          "url": "https://go.dev/issue/78371"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4867"
        }
      ],
      "title": "Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-27144",
    "datePublished": "2026-04-08T01:06:56.908Z",
    "dateReserved": "2026-02-17T19:57:28.435Z",
    "dateUpdated": "2026-04-13T18:20:28.098Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27145 (GCVE-0-2026-27145)

Vulnerability from cvelistv5 – Published: 2026-06-02 22:01 – Updated: 2026-09-18 12:04

Title

Inefficient candidate hostname parsing in crypto/x509

Summary

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-04 12:34 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity
CWE-606 - Unchecked Input for Loop Condition

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

100 references

URL	Tags
https://go.dev/cl/783621
https://go.dev/issue/79694
https://groups.google.com/g/golang-announce/c/tKs…
https://pkg.go.dev/vuln/GO-2026-5037
https://access.redhat.com/security/cve/CVE-2026-27145	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2484207	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:42079	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42080	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:68334	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:68335	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53416	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:50319	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54757	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57482	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42082	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42150	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42151	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42240	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49703	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49702	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53413	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53374	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54168	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51187	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:46394	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:46395	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29980	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35832	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34357	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39005	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42946	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39573	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38995	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41930	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61253	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60354	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57649	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53412	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60315	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49712	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53415	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54401	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29981	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34359	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39879	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36317	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54531	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61314	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54500	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41030	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44622	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47149	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53530	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:52946	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66022	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51057	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60387	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47737	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60390	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60388	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54427	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60391	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60386	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:63016	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42142	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33574	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23262	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23264	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54441	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42644	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36648	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41036	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60025	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57488	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54603	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49705	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49729	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49744	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49765	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49770	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:50205	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36797	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42043	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42047	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42050	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42051	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42049	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55899	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54435	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54525	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57194	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59556	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59593	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59557	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54432	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59579	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59558	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47735	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59559	vendor-advisoryx_refsource_REDHAT

Impacted products

233 products

Vendor	Product	Version
Go standard library	crypto/x509	Affected: 0 , < 1.25.11 (semver) Affected: 1.26.0-0 , < 1.26.4 (semver)
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	Unaffected: 0:1.6.7-1.el8ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.5::el8
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 9	Unaffected: 0:1.6.7-1.el9ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.5::el9
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 10	Unaffected: 0:1.6.6-1.el10ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.6::el10
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9	Unaffected: 0:1.6.6-1.el9ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.6::el9
Red Hat	Red Hat Ansible Automation Platform 2.7 for RHEL 10	Unaffected: 0:1.6.6-1.el10ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.7::el10
Red Hat	Red Hat Ansible Automation Platform 2.7 for RHEL 9	Unaffected: 0:1.6.6-1.el9ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.7::el9
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:1.26.4-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.152.1-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.9.27-7.el10_2.2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:0.3.8-6.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.4.9.2-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.2.10-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:1.0.0-4.el10_2.5 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:1.0.1-2.el10_2.3 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:1.26.5-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:1.26.1-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:0.4.7-5.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 1:0.3.2-5.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:0.152.1-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:0.2.3-6.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.4.0-8.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260710105056.a3795dee , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 1:0.2.5-9.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.26.4-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.152.1-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.22.2-7.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 1:0.2.7-8.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 1:0.2.2-1.el9_2.4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:1.26.5-1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:0.152.1-1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:1.26.5-1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 1:0.2.4-9.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:1.26.5-1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:0.152.1-1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 1:0.2.7-1.el9_6.5 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 0:0.23.0-5.rhaos4.18.el8 , < * (rpm) cpe:/a:redhat:openshift:4.18::el8
Red Hat	Red Hat OpenStack Platform 16.2	Unaffected: 0:0.2.1-1.1.el8ost , < * (rpm) cpe:/a:redhat:openstack:16.2::el8
Red Hat	Red Hat Satellite 6.16 for RHEL 8	Unaffected: 0:0.0.4-1.el8sat , < * (rpm) cpe:/a:redhat:satellite:6.16::el8
Red Hat	Red Hat Satellite 6.16 for RHEL 9	Unaffected: 0:0.0.4-1.el9sat , < * (rpm) cpe:/a:redhat:satellite:6.16::el9
Red Hat	Red Hat Satellite 6.17 for RHEL 9	Unaffected: 0:0.0.4-1.el9sat , < * (rpm) cpe:/a:redhat:satellite:6.17::el9
Red Hat	Red Hat Satellite 6.18 for RHEL 9	Unaffected: 0:0.0.4-1.el9sat , < * (rpm) cpe:/a:redhat:satellite:6.18::el9
Red Hat	Red Hat Satellite 6.19 for RHEL 9	Unaffected: 0:0.0.4-1.el9sat , < * (rpm) cpe:/a:redhat:satellite:6.19::el9
Red Hat	RHEM 1.1 for RHEL 10	Unaffected: 0:1.1.4-1.el10em , < * (rpm) cpe:/a:redhat:edge_manager:1.1::el10
Red Hat	RHEM 1.1 for RHEL 9	Unaffected: 0:1.1.4-1.el9em , < * (rpm) cpe:/a:redhat:edge_manager:1.1::el9
Red Hat	RHEM 1.2 for RHEL 10	Unaffected: 0:1.2.1-1.el10 , < * (rpm) cpe:/a:redhat:edge_manager:1.2::el10
Red Hat	RHEM 1.2 for RHEL 9	Unaffected: 0:1.2.1-1.el9 , < * (rpm) cpe:/a:redhat:edge_manager:1.2::el9
Red Hat	Streams for Apache Kafka 3.2.1	Unaffected: danielqsj-kafka_exporter , < * (rpm) cpe:/a:redhat:amq_streams:3.2::el9
Red Hat	Cert Manager support for Red Hat OpenShift release 1.19	Unaffected: 1786613805 , < * (rpm) cpe:/a:redhat:cert_manager:1.19::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1787593946 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Compliance Operator 1	Unaffected: 1786380082 , < * (rpm) cpe:/a:redhat:openshift_compliance_operator:1::el9
Red Hat	external secrets operator for Red Hat OpenShift 1.1	Unaffected: 1786614676 , < * (rpm) cpe:/a:redhat:external_secrets_operator:1.1::el9
Red Hat	multicluster engine for Kubernetes 2.1	Unaffected: 1786549223 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.10::el9
Red Hat	multicluster engine for Kubernetes 2.1	Unaffected: 1787201612 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.10::el9
Red Hat	multicluster engine for Kubernetes 2.1	Unaffected: 1786764622 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.10::el9
Red Hat	multicluster engine for Kubernetes 2.1	Unaffected: 1787176886 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.10::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786911941 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786911952 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786911945 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786912006 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786911973 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786911950 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786911984 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786907276 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1787238383 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1787239116 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1787239595 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.17	Unaffected: 1786577950 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.17::el9
Red Hat	multicluster engine for Kubernetes 2.17	Unaffected: 1786750700 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.17::el9
Red Hat	multicluster engine for Kubernetes 2.17	Unaffected: 1786983362 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.17::el9
Red Hat	multicluster engine for Kubernetes 2.17	Unaffected: 1786664288 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.17::el9
Red Hat	multicluster engine for Kubernetes 2.6	Unaffected: 1787259112 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.6::el9
Red Hat	multicluster engine for Kubernetes 2.6	Unaffected: 1787264185 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.6::el9
Red Hat	multicluster engine for Kubernetes 2.6	Unaffected: 1787259740 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.6::el9
Red Hat	multicluster engine for Kubernetes 2.6	Unaffected: 1787260821 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.6::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1784737366 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1784738758 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1784677239 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259015 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259059 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259011 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259016 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787258993 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259044 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259047 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259108 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259099 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259126 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259114 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259113 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.9	Unaffected: 1787195995 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.9::el9
Red Hat	multicluster engine for Kubernetes 2.9	Unaffected: 1787201646 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.9::el9
Red Hat	multicluster engine for Kubernetes 2.9	Unaffected: 1786764601 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.9::el9
Red Hat	multicluster engine for Kubernetes 2.9	Unaffected: 1787176716 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.9::el9
Red Hat	Multicluster Global Hub 1.4.5	Unaffected: 1784061472 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.4::el9
Red Hat	Multicluster Global Hub 1.6.5	Unaffected: 1784152046 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.6::el9
Red Hat	Multicluster Global Hub 1.7.0	Unaffected: 1784768332 , < * (rpm) Unaffected: 1785775948 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.7::el9
Red Hat	Multicluster Global Hub 1.8.0	Unaffected: 1785763319 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.8::el9
Red Hat	OpenShift API for Data Protection 1.5	Unaffected: 1788860461 , < * (rpm) cpe:/a:redhat:openshift_api_data_protection:1.5::el9
Red Hat	OpenShift Developer Tools and Services 1.6.3	Unaffected: 1784727697 , < * (rpm) cpe:/a:redhat:source_to_image:1.6::el8
Red Hat	OpenShift Developer Tools and Services 1.6.3	Unaffected: 1784728036 , < * (rpm) cpe:/a:redhat:source_to_image:1.6::el8
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.11	Unaffected: 1787260689 , < * (rpm) cpe:/a:redhat:acm:2.11::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.11	Unaffected: 1787262214 , < * (rpm) cpe:/a:redhat:acm:2.11::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.11	Unaffected: 1787260663 , < * (rpm) cpe:/a:redhat:acm:2.11::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.11	Unaffected: 1787263584 , < * (rpm) cpe:/a:redhat:acm:2.11::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	Unaffected: 1784677172 , < * (rpm) cpe:/a:redhat:acm:2.13::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	Unaffected: 1784638644 , < * (rpm) cpe:/a:redhat:acm:2.13::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	Unaffected: 1784590741 , < * (rpm) cpe:/a:redhat:acm:2.13::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	Unaffected: 1787259106 , < * (rpm) cpe:/a:redhat:acm:2.13::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	Unaffected: 1787259284 , < * (rpm) cpe:/a:redhat:acm:2.13::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	Unaffected: 1787259310 , < * (rpm) cpe:/a:redhat:acm:2.13::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	Unaffected: 1787263693 , < * (rpm) cpe:/a:redhat:acm:2.13::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.14	Unaffected: 1787183407 , < * (rpm) cpe:/a:redhat:acm:2.14::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.14	Unaffected: 1786976940 , < * (rpm) cpe:/a:redhat:acm:2.14::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.14	Unaffected: 1787172840 , < * (rpm) cpe:/a:redhat:acm:2.14::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.14	Unaffected: 1787170830 , < * (rpm) cpe:/a:redhat:acm:2.14::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.15	Unaffected: 1786547792 , < * (rpm) cpe:/a:redhat:acm:2.15::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.15	Unaffected: 1786547807 , < * (rpm) cpe:/a:redhat:acm:2.15::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.15	Unaffected: 1786549537 , < * (rpm) cpe:/a:redhat:acm:2.15::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	Unaffected: 1787252179 , < * (rpm) cpe:/a:redhat:acm:2.16::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	Unaffected: 1787242135 , < * (rpm) cpe:/a:redhat:acm:2.16::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	Unaffected: 1787242105 , < * (rpm) cpe:/a:redhat:acm:2.16::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	Unaffected: 1787242321 , < * (rpm) cpe:/a:redhat:acm:2.16::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	Unaffected: 1787243221 , < * (rpm) cpe:/a:redhat:acm:2.17::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	Unaffected: 1787242131 , < * (rpm) cpe:/a:redhat:acm:2.17::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	Unaffected: 1787242099 , < * (rpm) cpe:/a:redhat:acm:2.17::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	Unaffected: 1787242108 , < * (rpm) cpe:/a:redhat:acm:2.17::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	Unaffected: 1788105072 , < * (rpm) cpe:/a:redhat:acm:2.17::el9
Red Hat	Red Hat Ansible Automation Platform 2.7	Unaffected: 1783917963 , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.7::el9
Red Hat	Red Hat Developer Hub 1.9	Unaffected: 1782767215 , < * (rpm) cpe:/a:redhat:rhdh:1.9::el9
Red Hat	Red Hat Hardened Images	Unaffected: 1.25.11-2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 1.26.4-2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Lightspeed (formerly Insights) for Runtimes 1.0	Unaffected: 1786483782 , < * (rpm) cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9
Red Hat	Red Hat OpenShift AI 2.25	Unaffected: 1784004914 , < * (rpm) cpe:/a:redhat:openshift_ai:2.25::el9
Red Hat	Red Hat OpenShift Builds 1.7.3	Unaffected: 1783057868 , < * (rpm) cpe:/a:redhat:openshift_builds:1.7::el9
Red Hat	Red Hat OpenShift Builds 1.8.1	Unaffected: 1784121108 , < * (rpm) cpe:/a:redhat:openshift_builds:1.8::el9
Red Hat	Red Hat OpenShift Builds 1.8.1	Unaffected: 1783612119 , < * (rpm) cpe:/a:redhat:openshift_builds:1.8::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 1787554347 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 1786754425 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 1786526139 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift distributed tracing 3.10.2	Unaffected: 1785704636 , < * (rpm) cpe:/a:redhat:openshift_distributed_tracing:3.10::el9
Red Hat	Red Hat OpenShift distributed tracing 3.10.2	Unaffected: 1785704547 , < * (rpm) cpe:/a:redhat:openshift_distributed_tracing:3.10::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1784885742 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1784885559 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1784908682 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1784917979 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1784885281 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1784885133 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1784953556 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1784918113 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1784921753 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1784921772 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1784953743 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1784918117 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1784885810 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1784885681 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1784908639 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1785316150 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3.4	Unaffected: 1785131046 , < * (rpm) cpe:/a:redhat:service_mesh:3.4::el9
Red Hat	Red Hat OpenShift Service Mesh 3.4	Unaffected: 1785131063 , < * (rpm) cpe:/a:redhat:service_mesh:3.4::el9
Red Hat	Red Hat OpenShift Service Mesh 3.4	Unaffected: 1785131291 , < * (rpm) cpe:/a:redhat:service_mesh:3.4::el9
Red Hat	Red Hat OpenShift Service Mesh 3.4	Unaffected: 1785317214 , < * (rpm) cpe:/a:redhat:service_mesh:3.4::el9
Red Hat	Red Hat Trusted Artifact Signer 1.4	Unaffected: 4-1.4.2 , < * (rpm) Unaffected: 4-1.4.3 , < * (rpm) cpe:/a:redhat:trusted_artifact_signer:1.4::el9
Red Hat	Red Hat Web Terminal 1.11	Unaffected: 1784296203 , < * (rpm) cpe:/a:redhat:webterminal:1.11::el9
Red Hat	Red Hat Web Terminal 1.12	Unaffected: 1784247610 , < * (rpm) cpe:/a:redhat:webterminal:1.12::el9
Red Hat	Red Hat Web Terminal 1.13	Unaffected: 1784296127 , < * (rpm) cpe:/a:redhat:webterminal:1.13::el9
Red Hat	Red Hat Web Terminal 1.14	Unaffected: 1784296114 , < * (rpm) cpe:/a:redhat:webterminal:1.14::el9
Red Hat	Red Hat Web Terminal 1.15	Unaffected: 1784296033 , < * (rpm) cpe:/a:redhat:webterminal:1.15::el9
Red Hat	Red Hat Web Terminal 1.16	Unaffected: 1786654871 , < * (rpm) cpe:/a:redhat:webterminal:1.16::el9
Red Hat	Assisted Installer for Red Hat OpenShift Container Platform 2	cpe:/a:redhat:assisted_installer:2
Red Hat	Confidential Compute Attestation	cpe:/a:redhat:confidential_compute_attestation:1
Red Hat	Cryostat 4	cpe:/a:redhat:cryostat:4
Red Hat	Custom Metric Autoscaler operator for Red Hat Openshift	cpe:/a:redhat:openshift_custom_metrics_autoscaler:2
Red Hat	Deployment Validation Operator	cpe:/a:redhat:deployment_validator_operator
Red Hat	ExternalDNS Operator	cpe:/a:redhat:ext_dns_optr:1
Red Hat	Fence Agents Remediation Operator	cpe:/a:redhat:workload_availability_far:0
Red Hat	File Integrity Operator	cpe:/a:redhat:openshift_file_integrity_operator:1
Red Hat	Gatekeeper 3	cpe:/a:redhat:gatekeeper:3
Red Hat	Logging Subsystem for Red Hat OpenShift	cpe:/a:redhat:logging:6
Red Hat	Logical Volume Manager Storage	cpe:/a:redhat:lvms:4
Red Hat	Machine Deletion Remediation Operator	cpe:/a:redhat:workload_availability_mdr:0
Red Hat	Migration Toolkit for Applications 8	cpe:/a:redhat:migration_toolkit_applications:8
Red Hat	Migration Toolkit for Containers	cpe:/a:redhat:rhmt:1
Red Hat	mirror registry for Red Hat OpenShift 2	cpe:/a:redhat:mirror_registry:2
Red Hat	Multiarch Tuning Operator	cpe:/a:redhat:multiarch_tuning_operator
Red Hat	Multicluster Engine for Kubernetes	cpe:/a:redhat:multicluster_engine
Red Hat	Network Observability Operator	cpe:/a:redhat:network_observ_optr:1
Red Hat	Node HealthCheck Operator	cpe:/a:redhat:workload_availability_nhc:0
Red Hat	OpenShift Developer Tools and Services	cpe:/a:redhat:ocp_tools
Red Hat	OpenShift Lightspeed	cpe:/a:redhat:openshift_lightspeed
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	OpenShift Serverless	cpe:/a:redhat:serverless:1
Red Hat	OpenShift Service Mesh 2	cpe:/a:redhat:service_mesh:2
Red Hat	OpenShift Service Mesh 3	cpe:/a:redhat:service_mesh:3
Red Hat	Power monitoring for Red Hat OpenShift	cpe:/a:redhat:openshift_power_monitoring
Red Hat	Red Hat 3scale API Management Platform 2	cpe:/a:redhat:red_hat_3scale_amp:2
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	cpe:/a:redhat:acm:2
Red Hat	Red Hat Advanced Cluster Security 4	cpe:/a:redhat:advanced_cluster_security:4
Red Hat	Red Hat Ansible Automation Platform 2	cpe:/a:redhat:ansible_automation_platform:2
Red Hat	Red Hat Ceph Storage 5	cpe:/a:redhat:ceph_storage:5
Red Hat	Red Hat Ceph Storage 6	cpe:/a:redhat:ceph_storage:6
Red Hat	Red Hat Ceph Storage 7	cpe:/a:redhat:ceph_storage:7
Red Hat	Red Hat Ceph Storage 8	cpe:/a:redhat:ceph_storage:8
Red Hat	Red Hat Ceph Storage 9	cpe:/a:redhat:ceph_storage:9
Red Hat	Red Hat Connectivity Link 1	cpe:/a:redhat:connectivity_link:1
Red Hat	Red Hat Edge Manager 1	cpe:/a:redhat:edge_manager:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	cpe:/a:redhat:enterprise_linux_ai:3
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift Cluster Manager CLI	cpe:/a:redhat:openshift_cluster_manager_cli:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat Openshift Data Foundation 4	cpe:/a:redhat:openshift_data_foundation:4
Red Hat	Red Hat OpenShift Dev Spaces	cpe:/a:redhat:openshift_devspaces:3
Red Hat	Red Hat OpenShift Dev Workspaces Operator	cpe:/a:redhat:devworkspace
Red Hat	Red Hat OpenShift distributed tracing 3	cpe:/a:redhat:openshift_distributed_tracing:3
Red Hat	Red Hat OpenShift for Windows Containers	cpe:/a:redhat:windows_machine_config
Red Hat	Red Hat OpenShift GitOps	cpe:/a:redhat:openshift_gitops:1
Red Hat	Red Hat OpenShift on AWS	cpe:/a:redhat:openshift_service_on_aws:1
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenStack Platform 16.2	cpe:/a:redhat:openstack:16.2
Red Hat	Red Hat OpenStack Platform 17.1	cpe:/a:redhat:openstack:17.1
Red Hat	Red Hat OpenStack Platform 18.0	cpe:/a:redhat:openstack:18.0
Red Hat	Red Hat Quay 3	cpe:/a:redhat:quay:3
Red Hat	Red Hat Satellite 6	cpe:/a:redhat:satellite:6
Red Hat	Red Hat Service Interconnect 2	cpe:/a:redhat:service_interconnect:2
Red Hat	Security Profiles Operator	cpe:/a:redhat:openshift_security_profiles_operator:1
Red Hat	Service Telemetry Framework 1.5	cpe:/a:redhat:stf:1.5
Red Hat	streams for Apache Kafka 2	cpe:/a:redhat:amq_streams:2
Red Hat	Zero Trust Workload Identity Manager	cpe:/a:redhat:zero_trust_workload_identity_manager:1
Red Hat	Zero Trust Workload Identity Manager - Tech Preview	cpe:/a:redhat:zero_trust_workload_identity_manager:0

Credits

Jakub Ciolek - https://ciolek.dev/

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-27145",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T12:34:03.859208Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-04T12:34:53.136Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.5::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "receptor",
            "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.6.7-1.el8ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "receptor",
            "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.6.7-1.el9ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.6::el10"
            ],
            "defaultStatus": "affected",
            "packageName": "receptor",
            "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.6.6-1.el10ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "receptor",
            "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.6.6-1.el9ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.7::el10"
            ],
            "defaultStatus": "affected",
            "packageName": "receptor",
            "product": "Red Hat Ansible Automation Platform 2.7 for RHEL 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.6.6-1.el10ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.7::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "receptor",
            "product": "Red Hat Ansible Automation Platform 2.7 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.6.6-1.el9ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.4-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.152.1-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang-github-openprinting-ipp-usb",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.9.27-7.el10_2.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:0.3.8-6.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "yggdrasil",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.4.9.2-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc-worker-playbook",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.2.10-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "go-fdo-client",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.0.0-4.el10_2.5",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "go-fdo-server",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.0.1-2.el10_2.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "delve",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.1-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "yggdrasil",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.4.7-5.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:0.3.2-5.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.152.1-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc-worker-playbook",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.2.3-6.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "host-metering",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.4.0-8.el7_9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "go-toolset:rhel8",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260710105056.a3795dee",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:0.2.5-9.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.4-1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.152.1-1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "skopeo",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "2:1.22.2-7.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:0.2.7-8.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:0.2.2-1.el9_2.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.152.1-1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:0.2.4-9.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.152.1-1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:0.2.7-1.el9_6.5",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "butane",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.23.0-5.rhaos4.18.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "collectd-sensubility",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.2.1-1.1.el8ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6.16::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "yggdrasil-worker-forwarder",
            "product": "Red Hat Satellite 6.16 for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.0.4-1.el8sat",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "yggdrasil-worker-forwarder",
            "product": "Red Hat Satellite 6.16 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.0.4-1.el9sat",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "yggdrasil-worker-forwarder",
            "product": "Red Hat Satellite 6.17 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.0.4-1.el9sat",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "yggdrasil-worker-forwarder",
            "product": "Red Hat Satellite 6.18 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.0.4-1.el9sat",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "yggdrasil-worker-forwarder",
            "product": "Red Hat Satellite 6.19 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.0.4-1.el9sat",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.1::el10"
            ],
            "defaultStatus": "affected",
            "packageName": "flightctl",
            "product": "RHEM 1.1 for RHEL 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.1.4-1.el10em",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "flightctl",
            "product": "RHEM 1.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.1.4-1.el9em",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.2::el10"
            ],
            "defaultStatus": "affected",
            "packageName": "flightctl",
            "product": "RHEM 1.2 for RHEL 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.2.1-1.el10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "flightctl",
            "product": "RHEM 1.2 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.2.1-1.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "golang-github",
            "product": "Streams for Apache Kafka 3.2.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "danielqsj-kafka_exporter",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cert_manager:1.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cert-manager/jetstack-cert-manager-rhel9",
            "product": "Cert Manager support for Red Hat OpenShift release 1.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786613805",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/perses-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787593946",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_compliance_operator:1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "compliance/openshift-compliance-operator-bundle",
            "product": "Compliance Operator 1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786380082",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:external_secrets_operator:1.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "external-secrets-operator/external-secrets-rhel9",
            "product": "external secrets operator for Red Hat OpenShift 1.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786614676",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786549223",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-curator-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787201612",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-image-set-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786764622",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/provider-credential-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787176886",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/addon-manager-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911941",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/backplane-rhel9-operator",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911952",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/clusterlifecycle-state-metrics-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911945",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/hypershift-addon-rhel9-operator",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786912006",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/managedcluster-import-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911973",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/multicloud-manager-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911950",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/placement-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911984",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/registration-operator-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911984",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/work-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786907276",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-curator-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787238383",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-image-set-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787239116",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/provider-credential-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787239595",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786577950",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-curator-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786750700",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-image-set-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786983362",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/provider-credential-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786664288",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259112",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-curator-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787264185",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-image-set-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259740",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/provider-credential-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787260821",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/backplane-rhel9-operator",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784737366",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/hypershift-addon-rhel9-operator",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784738758",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/kube-rbac-proxy-mce-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784677239",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/addon-manager-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259015",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259059",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-curator-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259011",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-image-set-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259016",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/clusterlifecycle-state-metrics-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787258993",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/managedcluster-import-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259044",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/multicloud-manager-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259047",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/placement-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259108",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/provider-credential-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259099",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/registration-operator-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259126",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/registration-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259114",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/work-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259113",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787195995",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-curator-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787201646",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-image-set-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786764601",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/provider-credential-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787176716",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
            "product": "Multicluster Global Hub 1.4.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784061472",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
            "product": "Multicluster Global Hub 1.6.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784152046",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.7::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
            "product": "Multicluster Global Hub 1.7.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784768332",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785775948",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
            "product": "Multicluster Global Hub 1.8.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785763319",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "oadp/oadp-velero-rhel9",
            "product": "OpenShift API for Data Protection 1.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1788860461",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:source_to_image:1.6::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "source-to-image/source-to-image-rhel8",
            "product": "OpenShift Developer Tools and Services 1.6.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784727697",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:source_to_image:1.6::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "source-to-image/source-to-image-rhel9",
            "product": "OpenShift Developer Tools and Services 1.6.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784728036",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicloud-integrations-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787260689",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-application-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787262214",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-channel-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787260663",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787263584",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/kube-rbac-proxy-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784677172",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multiclusterhub-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784638644",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-observability-rhel9-operator",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784590741",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicloud-integrations-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259106",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-application-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259284",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-channel-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259310",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787263693",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicloud-integrations-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787183407",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-application-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786976940",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-channel-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787172840",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787170830",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-application-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786547792",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-channel-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786547807",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786549537",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicloud-integrations-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787252179",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-application-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787242135",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-channel-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787242105",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787242321",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicloud-integrations-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787243221",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-application-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787242131",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-channel-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787242099",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787242108",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/subctl-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1788105072",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.7::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform-27/receptor-rhel9",
            "product": "Red Hat Ansible Automation Platform 2.7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783917963",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-rhel9-operator",
            "product": "Red Hat Developer Hub 1.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782767215",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "golang1-25-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.25.11-2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "golang1-26-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.26.4-2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator",
            "product": "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786483782",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-rhel9-operator",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784004914",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_builds:1.7::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-builds/openshift-builds-waiters-rhel9",
            "product": "Red Hat OpenShift Builds 1.7.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783057868",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_builds:1.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-builds/openshift-builds-rhel9-operator",
            "product": "Red Hat OpenShift Builds 1.8.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784121108",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_builds:1.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-builds/openshift-builds-waiters-rhel9",
            "product": "Red Hat OpenShift Builds 1.8.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783612119",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-ansible-rhel9-operator",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787554347",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-ansible-rhel9-operator",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786754425",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-ansible-rhel9-operator",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786526139",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_distributed_tracing:3.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosdt/opentelemetry-collector-rhel9",
            "product": "Red Hat OpenShift distributed tracing 3.10.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785704636",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_distributed_tracing:3.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosdt/opentelemetry-rhel9-operator",
            "product": "Red Hat OpenShift distributed tracing 3.10.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785704547",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784885742",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784885559",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784908682",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784917979",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784885281",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784885133",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784953556",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784918113",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784921753",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784921772",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784953743",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784918117",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784885810",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784885681",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784908639",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785316150",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785131046",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785131063",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785131291",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785317214",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "conforma-cli-stack-v1",
            "product": "Red Hat Trusted Artifact Signer 1.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4-1.4.2",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4-1.4.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784296203",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.12::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784247610",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784296127",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784296114",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784296033",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786654871",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:assisted_installer:2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhai/assisted-installer-rhel9",
            "product": "Assisted Installer for Red Hat OpenShift Container Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:confidential_compute_attestation:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "build-of-trustee/trustee-rhel9-operator",
            "product": "Confidential Compute Attestation",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:confidential_compute_attestation:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-sandboxed-containers/osc-monitor-rhel9",
            "product": "Confidential Compute Attestation",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "cryostat/cryostat-storage-rhel9",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9",
            "product": "Custom Metric Autoscaler operator for Red Hat Openshift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:deployment_validator_operator"
            ],
            "defaultStatus": "affected",
            "packageName": "dvo/deployment-validation-rhel8-operator",
            "product": "Deployment Validation Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ext_dns_optr:1"
            ],
            "defaultStatus": "affected",
            "packageName": "edo/external-dns-rhel9",
            "product": "ExternalDNS Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ext_dns_optr:1"
            ],
            "defaultStatus": "affected",
            "packageName": "edo/external-dns-rhel9-operator",
            "product": "ExternalDNS Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_far:0"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/fence-agents-remediation-rhel8-operator",
            "product": "Fence Agents Remediation Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_file_integrity_operator:1"
            ],
            "defaultStatus": "affected",
            "packageName": "compliance/openshift-compliance-operator-bundle",
            "product": "File Integrity Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:gatekeeper:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "gatekeeper/gatekeeper-rhel9-operator",
            "product": "Gatekeeper 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:logging:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-logging/eventrouter-rhel9",
            "product": "Logging Subsystem for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lvms:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "lvms4/lvms-rhel9-operator",
            "product": "Logical Volume Manager Storage",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lvms:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "lvms4/topolvm-rhel8",
            "product": "Logical Volume Manager Storage",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lvms:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "lvms4/topolvm-rhel9",
            "product": "Logical Volume Manager Storage",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_mdr:0"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/machine-deletion-remediation-rhel8-operator",
            "product": "Machine Deletion Remediation Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:migration_toolkit_applications:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "mta/mta-cli-rhel9",
            "product": "Migration Toolkit for Applications 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhmt:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhmtc/openshift-migration-registry-rhel8",
            "product": "Migration Toolkit for Containers",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:mirror_registry:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift/mirror-registry-rhel8",
            "product": "mirror registry for Red Hat OpenShift 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multiarch_tuning_operator"
            ],
            "defaultStatus": "affected",
            "packageName": "multiarch-tuning/multiarch-tuning-rhel9-operator",
            "product": "Multiarch Tuning Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/assisted-service-9-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "unaffected",
            "packageName": "multicluster-engine/discovery-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/hive-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/maestro-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:network_observ_optr:1"
            ],
            "defaultStatus": "affected",
            "packageName": "network-observability/network-observability-cli-rhel9",
            "product": "Network Observability Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0"
            ],
            "defaultStatus": "affected",
            "packageName": "node-healthcheck-operator-tech-preview/node-healthcheck-operator-rhel8",
            "product": "Node HealthCheck Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0"
            ],
            "defaultStatus": "affected",
            "packageName": "node-healthcheck-operator-tech-preview/node-healthcheck-rhel8-operator",
            "product": "Node HealthCheck Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/node-healthcheck-rhel8-operator",
            "product": "Node HealthCheck Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools"
            ],
            "defaultStatus": "unaffected",
            "packageName": "helm",
            "product": "OpenShift Developer Tools and Services",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_lightspeed"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-lightspeed/lightspeed-rhel9-operator",
            "product": "OpenShift Lightspeed",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines-client",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-scheduler-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kn-workflow-plugin",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-serverless-1/kn-plugin-event-sender-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-serverless-1/logic-rhel9-operator",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-clients",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-service-mesh/kiali-rhel8",
            "product": "OpenShift Service Mesh 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rh-osbs/openshift-golang-builder",
            "product": "OpenShift Service Mesh 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-service-mesh/kiali-rhel9",
            "product": "OpenShift Service Mesh 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_power_monitoring"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-power-monitoring/kepler-rhel9",
            "product": "Power monitoring for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_3scale_amp:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "3scale-amp2/3scale-rhel7-operator",
            "product": "Red Hat 3scale API Management Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_3scale_amp:2"
            ],
            "defaultStatus": "affected",
            "packageName": "3scale-amp2/3scale-rhel9-operator",
            "product": "Red Hat 3scale API Management Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/acm-governance-policy-addon-controller-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/acm-governance-policy-framework-addon-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/acm-volsync-addon-controller-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/config-policy-controller-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/governance-policy-propagator-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/klusterlet-addon-controller-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/thanos-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "advanced-cluster-security/rhacs-main-rhel8",
            "product": "Red Hat Advanced Cluster Security 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "advanced-cluster-security/rhacs-main-rhel9",
            "product": "Red Hat Advanced Cluster Security 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ansible-automation-platform/platform-operator-bundle",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "automation-gateway-proxy",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "automation-gateway-proxy-openssl30",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "automation-gateway-proxy-openssl32",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python3.11-galaxy-ng",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python3.11-grpcio",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python3.12-galaxy-ng",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python3.12-grpcio",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python3x-grpcio",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python-grpcio",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:5"
            ],
            "defaultStatus": "affected",
            "packageName": "rhceph/snmp-notifier-rhel8",
            "product": "Red Hat Ceph Storage 5",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:6"
            ],
            "defaultStatus": "affected",
            "packageName": "rhceph/snmp-notifier-rhel9",
            "product": "Red Hat Ceph Storage 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhceph/grafana-rhel9",
            "product": "Red Hat Ceph Storage 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhceph/grafana-rhel9",
            "product": "Red Hat Ceph Storage 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhceph/alloy-rhel10",
            "product": "Red Hat Ceph Storage 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:connectivity_link:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcl-1/authorino-rhel9",
            "product": "Red Hat Connectivity Link 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:connectivity_link:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcl-1/coredns-rhel9",
            "product": "Red Hat Connectivity Link 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhem/flightctl-ui-rhel9",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "buildah",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "butane",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "conmon",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "delve",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "git-lfs",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana-pcp",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "gvisor-tap-vsock",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ignition",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "image-builder",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "podman",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhel10/bootc-image-builder",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhel10-eus/rhel-10.0-bootc-image-builder",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "skopeo",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "toolbox",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "trustee",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "trustee-guest-components",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhc-worker-script",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/buildah",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/conmon",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/containernetworking-plugins",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/podman",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/runc",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/skopeo",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/toolbox",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "git-lfs",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana-pcp",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "weldr-client",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "buildah",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "butane",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "conmon",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "containernetworking-plugins",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "git-lfs",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana-pcp",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "gvisor-tap-vsock",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ignition",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "image-builder",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "podman",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhel9/bootc-image-builder",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhel9-eus/rhel-9.6-bootc-image-builder",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "runc",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "toolbox",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "trustee-guest-components",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "weldr-client",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-rhel8-operator",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/rhai-cli-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_cluster_manager_cli:1"
            ],
            "defaultStatus": "affected",
            "packageName": "ocm-cli-clients/ocm-cli-rhel9",
            "product": "Red Hat OpenShift Cluster Manager CLI",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "conmon",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "conmon-rs",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "containernetworking-plugins",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-tools",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "golang-github-prometheus-promu",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ignition",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kata-containers",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "microshift",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/frr-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-ansible-operator",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/ose-cli",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-hypershift-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-clients",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-kuryr",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ose-aws-ecr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ose-azure-acr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ose-crio-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ose-gcp-gcr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "podman",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "rh-osbs/openshift-golang-builder",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "runc",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "skopeo",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "devspaces/udi-rhel9",
            "product": "Red Hat OpenShift Dev Spaces",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:devworkspace"
            ],
            "defaultStatus": "affected",
            "packageName": "devworkspace/devworkspace-rhel9-operator",
            "product": "Red Hat OpenShift Dev Workspaces Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_distributed_tracing:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosdt/tempo-rhel9",
            "product": "Red Hat OpenShift distributed tracing 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:windows_machine_config"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator",
            "product": "Red Hat OpenShift for Windows Containers",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_gitops:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-gitops-1/dex-rhel8",
            "product": "Red Hat OpenShift GitOps",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_gitops:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-gitops-1/dex-rhel9",
            "product": "Red Hat OpenShift GitOps",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_service_on_aws:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rosa",
            "product": "Red Hat OpenShift on AWS",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-native-virtualization/kubevirt-apiserver-proxy-rhel9",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-native-virtualization/kubevirt-redfish-rhel9",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kubevirt",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "affected",
            "packageName": "rh-osbs/openshift-golang-builder",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "etcd",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang-github-infrawatch-apputils",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "affected",
            "packageName": "collectd-libpod-stats",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "etcd",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "affected",
            "packageName": "golang-github-infrawatch-apputils",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-rhel9/osp-director-agent",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0"
            ],
            "defaultStatus": "affected",
            "packageName": "golang-github-openstack-k8s-operators-os-diff",
            "product": "Red Hat OpenStack Platform 18.0",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoso-operators/sg-core-rhel9",
            "product": "Red Hat OpenStack Platform 18.0",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quay:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quay:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "quay/quay-rhel9",
            "product": "Red Hat Quay 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "affected",
            "packageName": "satellite:el8/yggdrasil-worker-forwarder",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "satellite/iop-vmaas-rhel9",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_interconnect:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "skupper-cli",
            "product": "Red Hat Service Interconnect 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_security_profiles_operator:1"
            ],
            "defaultStatus": "affected",
            "packageName": "compliance/openshift-selinuxd-rhel8",
            "product": "Security Profiles Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:stf:1.5"
            ],
            "defaultStatus": "unaffected",
            "packageName": "stf/sg-core-rhel9",
            "product": "Service Telemetry Framework 1.5",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang-github-danielqsj-kafka_exporter",
            "product": "streams for Apache Kafka 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "zero-trust-workload-identity-manager/spiffe-csi-driver-rhel9",
            "product": "Zero Trust Workload Identity Manager",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
            ],
            "defaultStatus": "affected",
            "packageName": "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9",
            "product": "Zero Trust Workload Identity Manager - Tech Preview",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-02T22:01:36.954Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-606",
                "description": "Unchecked Input for Loop Condition",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T12:04:41.189Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-27145"
          },
          {
            "name": "RHBZ#2484207",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42079"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42080"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:68334"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:68335"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53416"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50319"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54757"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57482"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42082"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42150"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42151"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42240"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49703"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49702"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53413"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53374"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54168"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51187"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:46394"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:46395"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29980"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35832"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34357"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39005"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42946"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39573"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38995"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41930"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61253"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60354"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57649"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53412"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60315"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49712"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53415"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54401"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29981"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34359"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39879"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36317"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54531"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61314"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54500"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41030"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44622"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47149"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53530"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:52946"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66022"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51057"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60387"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47737"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60390"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60388"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54427"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60391"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60386"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:63016"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42142"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33574"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23262"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23264"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54441"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36648"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41036"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60025"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57488"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54603"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49705"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49729"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49744"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49765"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49770"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50205"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36797"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42043"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42047"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42050"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42051"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42049"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55899"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54435"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54525"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57194"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59556"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59593"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59557"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54432"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59579"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59558"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47735"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59559"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:42079: Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42080: Red Hat Ansible Automation Platform 2.7 for RHEL 10, Red Hat Ansible Automation Platform 2.7 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:68334: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:68335: RHEM 1.2 for RHEL 10, RHEM 1.2 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53416: Red Hat Enterprise Linux Server (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:50319: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54757: Red Hat OpenStack Platform 16.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57482: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42082: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42150: Red Hat Satellite 6.17 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42151: Red Hat Satellite 6.18 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42240: Red Hat Satellite 6.19 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49703: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49702: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53413: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53374: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54168: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51187: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:46394: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:46395: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29980: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35832: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34357: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39005: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42946: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39573: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:38995: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41930: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:61253: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60354: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57649: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53412: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60315: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49712: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53415: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54401: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29981: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34359: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39879: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36317: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54531: Cert Manager support for Red Hat OpenShift release 1.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:61314: Cluster Observability Operator 1.5.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54500: Compliance Operator 1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41030: Multicluster Global Hub 1.4.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44622: Multicluster Global Hub 1.6.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47149: Multicluster Global Hub 1.7.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53530: Multicluster Global Hub 1.7.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:52946: Multicluster Global Hub 1.8.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66022: OpenShift API for Data Protection 1.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51057: OpenShift Developer Tools and Services 1.6.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60387: Red Hat Advanced Cluster Management for Kubernetes 2.11"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47737: Red Hat Advanced Cluster Management for Kubernetes 2.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60390: Red Hat Advanced Cluster Management for Kubernetes 2.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60388: Red Hat Advanced Cluster Management for Kubernetes 2.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54427: Red Hat Advanced Cluster Management for Kubernetes 2.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60391: Red Hat Advanced Cluster Management for Kubernetes 2.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60386: Red Hat Advanced Cluster Management for Kubernetes 2.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:63016: Red Hat Advanced Cluster Management for Kubernetes 2.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42142: Red Hat Ansible Automation Platform 2.7"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33574: Red Hat Developer Hub 1.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23262: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23264: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54441: Red Hat Lightspeed (formerly Insights) for Runtimes 1.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36648: Red Hat OpenShift Builds 1.7.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41036: Red Hat OpenShift Builds 1.8.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60025: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57488: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54603: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49705: Red Hat OpenShift Service Mesh 3.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49729: Red Hat OpenShift Service Mesh 3.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49744: Red Hat OpenShift Service Mesh 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49765: Red Hat OpenShift Service Mesh 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49770: Red Hat OpenShift Service Mesh 3.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:50205: Red Hat OpenShift distributed tracing 3.10.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36797: Red Hat Trusted Artifact Signer 1.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42043: Red Hat Web Terminal 1.11"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42047: Red Hat Web Terminal 1.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42050: Red Hat Web Terminal 1.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42051: Red Hat Web Terminal 1.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42049: Red Hat Web Terminal 1.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55899: Red Hat Web Terminal 1.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54525: external secrets operator for Red Hat OpenShift 1.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57194: multicluster engine for Kubernetes 2.11"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59556: multicluster engine for Kubernetes 2.11"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59593: multicluster engine for Kubernetes 2.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59557: multicluster engine for Kubernetes 2.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54432: multicluster engine for Kubernetes 2.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59579: multicluster engine for Kubernetes 2.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59558: multicluster engine for Kubernetes 2.8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47735: multicluster engine for Kubernetes 2.8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59559: multicluster engine for Kubernetes 2.9"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-02T23:01:08.992Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-02T22:01:36.954Z",
            "value": "Made public."
          }
        ],
        "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
        "workarounds": [
          {
            "lang": "en",
            "value": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037)."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/x509",
          "product": "crypto/x509",
          "programRoutines": [
            {
              "name": "HostnameError.Error"
            },
            {
              "name": "matchHostnames"
            },
            {
              "name": "Certificate.Verify"
            },
            {
              "name": "Certificate.VerifyHostname"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.4",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jakub Ciolek - https://ciolek.dev/"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname\u0027s label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T22:01:36.954Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/783621"
        },
        {
          "url": "https://go.dev/issue/79694"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5037"
        }
      ],
      "title": "Inefficient candidate hostname parsing in crypto/x509"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-27145",
    "datePublished": "2026-06-02T22:01:36.954Z",
    "dateReserved": "2026-02-17T19:57:28.435Z",
    "dateUpdated": "2026-09-18T12:04:41.189Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:87246

CVE-2024-45336 (GCVE-0-2024-45336)

CVE-2025-22866 (GCVE-0-2025-22866)

CVE-2025-22874 (GCVE-0-2025-22874)

CVE-2025-4673 (GCVE-0-2025-4673)

CVE-2025-68121 (GCVE-0-2025-68121)

CVE-2026-111943 (GCVE-0-2026-111943)

CVE-2026-27137 (GCVE-0-2026-27137)

CVE-2026-27143 (GCVE-0-2026-27143)

CVE-2026-27144 (GCVE-0-2026-27144)

CVE-2026-27145 (GCVE-0-2026-27145)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour