RHSA-2026:87400
Vulnerability from csaf_redhat - Published: 2026-10-21 19:53 - Updated: 2026-10-23 05:22Summary
Red Hat Security Advisory: Red Hat Cost Management On-Premise container image update
Severity
Important
Notes
Topic: Updated container image for Red Hat Cost Management On-Premise is now available.
Details: Red Hat Cost Management On-Premise provides cost visibility and analysis for on-premise OpenShift environments. This update includes the latest bug fixes and enhancements.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libcurl. An application using libcurl that performs an authenticated HTTP(S) request after a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection. This authentication bypass vulnerability allows the second request to be sent over a connection authenticated with different credentials, potentially leading to unauthorized access or information disclosure.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy's credentials. This improper credential management (CWE-522) may allow an attacker to gain unauthorized access or information by intercepting these disclosed credentials.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Moderate
A flaw was found in libcurl. When configured to use a .netrc file for credentials and follow HTTP redirects, libcurl can inadvertently send the password from the initial connection to the redirected host. This sensitive information disclosure occurs when both the original and redirect URLs use clear text HTTP, are performed over the same HTTP proxy, and the same connection is reused. This vulnerability, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200), could allow an attacker to obtain user credentials.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Moderate
A flaw was found in libcurl. When a user performs a transfer over an HTTP proxy using Digest authentication and then reuses the same handle for a second transfer with a different proxy host, libcurl incorrectly sends the `Proxy-Authorization` header intended for the first proxy to the second proxy. This could lead to the disclosure of sensitive authentication information to an unintended proxy, potentially allowing an attacker to gain unauthorized access or impersonate the user.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Moderate
A flaw was found in the GNU C Library (glibc) DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from /etc/resolv.conf or the LOCALDOMAIN environment variable, it triggers an assertion failure, which aborts the process. This can be exploited without privileges on the target system, potentially through network configuration mechanisms like DHCP or a VPN server.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Moderate
A flaw was found in libcurl. This use-after-free vulnerability occurs when an application configures an HTTP/2 stream-dependency tree and then performs a sequence of operations involving `curl_easy_reset()` and `curl_easy_cleanup()`. During the final cleanup, libcurl attempts to access memory that has already been released. This can lead to application crashes, resulting in a Denial of Service (DoS).
4.7 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Moderate
A flaw was found in the GNU C Library (glibc). This vulnerability could allow an attacker with local access to trigger a heap buffer overflow by manipulating how the `fopen` function handles certain input. This could lead to minor disruptions in system operations or limited access to sensitive information.
4.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Moderate
A flaw was found in Python. A remote, unauthenticated TLS client can cause a use-after-free in a server that uses SSLContext.sni_callback to assign a different SSLSocket.context when selecting a certificate per server name, if nothing else keeps the original SSLContext alive. This can crash the server process or result in a call through a freed pointer. Servers that wrap their listening socket with a long-lived SSLContext are not affected. TLS clients are not affected.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Important
A flaw was found in Python. When establishing secure connections using the SSLContext.wrap_bio() function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rather than triggering an error. A remote man-in-the-middle attacker could exploit this defect to spoof trusted endpoints and intercept or tamper with sensitive encrypted traffic.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Important
A flaw was found in the URI component for Perl. This vulnerability occurs because the `nameprep` function, responsible for encoding hostnames, does not properly normalize Unicode characters. As a result, a hostname that is not in a standard Unicode form (non-NFC) can be encoded into a non-standard label. This discrepancy can lead to a situation where security checks, such as allow lists or Server-Side Request Forgery (SSRF) filters, may incorrectly process hostnames, potentially allowing an attacker to bypass security restrictions.
7.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Moderate
A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Moderate
A flaw was found in glibc. Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding (for example with iconv) can cause the converter to make no progress, hanging the calling application. Some EUC_JISX0213 sequences decode to two code points; if the output buffer has room for only the first, the second is stored in conversion state and returned as E2BIG, but that pending character is never cleared after it is emitted on the next call, so retries loop forever without consuming further input.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Moderate
A flaw was found in PCRE2. An attacker can provide invalid UTF (Unicode Transformation Format) data, leading to an out-of-bounds read during a Just-In-Time (JIT) fallback. This vulnerability could potentially result in a denial of service.
CWE-125 - Out-of-bounds ReadAffected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Low
A flaw was found in PCRE2. On 32-bit platforms, an attacker can provide a specially crafted large pattern, leading to an out-of-bounds write within the pcre2_pattern_convert function. This vulnerability can result in high integrity impact, such as data corruption, and potentially a low availability impact, causing a denial of service.
5.7 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Moderate
A flaw was found in PCRE2. On 32-bit platforms, an integer overflow in the `pcre2_compile_32` function can lead to an out-of-bounds write. This vulnerability could allow a remote attacker to achieve a high integrity impact and a low availability impact, potentially leading to data corruption or denial of service.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Moderate
A flaw was found in PCRE2, a library for processing regular expressions. A remote attacker could exploit this vulnerability by providing a specially crafted input that triggers an out-of-bounds read during pattern matching with invalid UTF (Unicode Transformation Format) characters. This could lead to a denial of service, making the affected system or application unavailable.
CWE-125 - Out-of-bounds ReadAffected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Low
A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Important
A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).
7.6 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5545
Threats
Impact
Important
References
130 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated container image for Red Hat Cost Management On-Premise is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Cost Management On-Premise provides cost visibility and analysis for on-premise OpenShift environments. This update includes the latest bug fixes and enhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:87400",
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "external",
"summary": "https://access.redhat.com/articles/7148128",
"url": "https://access.redhat.com/articles/7148128"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-103111",
"url": "https://access.redhat.com/security/cve/CVE-2026-103111"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-10536",
"url": "https://access.redhat.com/security/cve/CVE-2026-10536"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-18374",
"url": "https://access.redhat.com/security/cve/CVE-2026-18374"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-19445",
"url": "https://access.redhat.com/security/cve/CVE-2026-19445"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-19553",
"url": "https://access.redhat.com/security/cve/CVE-2026-19553"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-19953",
"url": "https://access.redhat.com/security/cve/CVE-2026-19953"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5545",
"url": "https://access.redhat.com/security/cve/CVE-2026-5545"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6253",
"url": "https://access.redhat.com/security/cve/CVE-2026-6253"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6429",
"url": "https://access.redhat.com/security/cve/CVE-2026-6429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-7168",
"url": "https://access.redhat.com/security/cve/CVE-2026-7168"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-77117",
"url": "https://access.redhat.com/security/cve/CVE-2026-77117"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-80489",
"url": "https://access.redhat.com/security/cve/CVE-2026-80489"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-8674",
"url": "https://access.redhat.com/security/cve/CVE-2026-8674"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-89156",
"url": "https://access.redhat.com/security/cve/CVE-2026-89156"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-89157",
"url": "https://access.redhat.com/security/cve/CVE-2026-89157"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-89158",
"url": "https://access.redhat.com/security/cve/CVE-2026-89158"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-89160",
"url": "https://access.redhat.com/security/cve/CVE-2026-89160"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-89161",
"url": "https://access.redhat.com/security/cve/CVE-2026-89161"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification",
"url": "https://access.redhat.com/security/updates/classification"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/cost_management_service/1-latest/html/getting_started_with_cost_management/steps-to-cost-management",
"url": "https://docs.redhat.com/en/documentation/cost_management_service/1-latest/html/getting_started_with_cost_management/steps-to-cost-management"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_87400.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Cost Management On-Premise container image update",
"tracking": {
"current_release_date": "2026-10-23T05:22:04+00:00",
"generator": {
"date": "2026-10-23T05:22:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.2"
}
},
"id": "RHSA-2026:87400",
"initial_release_date": "2026-10-21T19:53:23+00:00",
"revision_history": [
{
"date": "2026-10-21T19:53:23+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-21T19:53:29+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-23T05:22:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Cost Management On-Premise 1",
"product": {
"name": "Red Hat Cost Management On-Premise 1",
"product_id": "Red Hat Cost Management On-Premise 1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:cost_management_on_premise:1::el10"
}
}
}
],
"category": "product_family",
"name": "Red Hat Cost Management On-Premise"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64",
"product": {
"name": "registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64",
"product_id": "registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64",
"product_identification_helper": {
"purl": "pkg:oci/costmanagement-ui-rhel10@sha256%3A4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db?arch=amd64\u0026repository_url=registry.redhat.io/costmanagement/costmanagement-ui-rhel10\u0026tag=1792605272"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64 as a component of Red Hat Cost Management On-Premise 1",
"product_id": "Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
},
"product_reference": "registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64",
"relates_to_product_reference": "Red Hat Cost Management On-Premise 1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-5545",
"cwe": {
"id": "CWE-488",
"name": "Exposure of Data Element to Wrong Session"
},
"discovery_date": "2026-04-23T16:35:33.607000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461204"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcurl. An application using libcurl that performs an authenticated HTTP(S) request after a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection. This authentication bypass vulnerability allows the second request to be sent over a connection authenticated with different credentials, potentially leading to unauthorized access or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: A flaw in libcurl allows for the wrong reuse of HTTP Negotiate authenticated connections. This can occur when an application makes an authenticated HTTP(S) request after a Negotiate-authenticated one to the same host, potentially leading to a request being sent over a connection authenticated with unintended credentials. This issue affects applications using libcurl versions from 7.10.6 up to and including 8.19.0.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5545"
},
{
"category": "external",
"summary": "RHBZ#2461204",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461204"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5545"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5545",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5545"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-5545.html",
"url": "https://curl.se/docs/CVE-2026-5545.html"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications using libcurl can disable connection reuse. This can be achieved by setting one of the following libcurl options: CURLOPT_FRESH_CONNECT to force a new connection for each request, CURLOPT_MAXCONNECTS to limit the total number of open connections, or CURLMOPT_MAX_HOST_CONNECTIONS when using the curl_multi API to limit connections per host. Disabling connection reuse may impact application performance due to increased overhead for establishing new connections.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse"
},
{
"cve": "CVE-2026-6253",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-04-23T16:35:33.623000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461202"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy\u0027s credentials. This improper credential management (CWE-522) may allow an attacker to gain unauthorized access or information by intercepting these disclosed credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: This flaw in curl and libcurl allows proxy credentials to be inadvertently exposed to a second proxy during a redirect. This issue arises when curl is configured to use distinct proxies for different URL schemes, the initial proxy requires authentication, and a subsequent proxy does not. Red Hat products utilizing curl or libcurl in such a specific proxy chaining configuration may be affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6253"
},
{
"category": "external",
"summary": "RHBZ#2461202",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461202"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6253"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6253",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6253"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-6253.html",
"url": "https://curl.se/docs/CVE-2026-6253.html"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid configuring curl or libcurl to use proxies that require credentials. This prevents the scenario where credentials for a first proxy could be inadvertently passed to a second proxy during a redirect.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies"
},
{
"cve": "CVE-2026-6429",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-04-23T16:35:34.628000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461205"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcurl. When configured to use a .netrc file for credentials and follow HTTP redirects, libcurl can inadvertently send the password from the initial connection to the redirected host. This sensitive information disclosure occurs when both the original and redirect URLs use clear text HTTP, are performed over the same HTTP proxy, and the same connection is reused. This vulnerability, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200), could allow an attacker to obtain user credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: libcurl: Credential leak via reused proxy connection during HTTP redirects",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: A flaw in libcurl could lead to credential leakage. This issue occurs when libcurl is configured to use a `.netrc` file for credentials and follows HTTP redirects, potentially exposing passwords to the redirected host. Exploitation requires both the original and redirect URLs to be clear text HTTP, performed over the same HTTP proxy, and with connection reuse. The curl command-line tool is not affected by this vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6429"
},
{
"category": "external",
"summary": "RHBZ#2461205",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461205"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6429"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-6429.html",
"url": "https://curl.se/docs/CVE-2026-6429.html"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "To prevent the credential leak, avoid using the combination of .netrc for credentials, clear text HTTP URLs, and an HTTP proxy when making requests with libcurl. This operational control prevents the specific conditions that enable the vulnerability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: libcurl: Credential leak via reused proxy connection during HTTP redirects"
},
{
"cve": "CVE-2026-7168",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-05-13T10:01:12.117148+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2476979"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcurl. When a user performs a transfer over an HTTP proxy using Digest authentication and then reuses the same handle for a second transfer with a different proxy host, libcurl incorrectly sends the `Proxy-Authorization` header intended for the first proxy to the second proxy. This could lead to the disclosure of sensitive authentication information to an unintended proxy, potentially allowing an attacker to gain unauthorized access or impersonate the user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: A flaw in libcurl allows for information disclosure when a client reuses a handle for HTTP proxy transfers. If a libcurl application uses Digest authentication with one proxy and then connects to a different proxy using the same handle, the `Proxy-Authorization` header from the initial connection may be inadvertently sent to the second proxy, potentially exposing sensitive authentication data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-7168"
},
{
"category": "external",
"summary": "RHBZ#2476979",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476979"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-7168",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-7168"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-7168",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7168"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/29/14",
"url": "http://www.openwall.com/lists/oss-security/2026/04/29/14"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-7168.html",
"url": "https://curl.se/docs/CVE-2026-7168.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-7168.json",
"url": "https://curl.se/docs/CVE-2026-7168.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3697719",
"url": "https://hackerone.com/reports/3697719"
}
],
"release_date": "2026-05-13T08:29:08.900000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications using libcurl should avoid reusing handles when switching between different HTTP proxies, especially after performing Digest authentication. This operational control prevents the unintended disclosure of `Proxy-Authorization` headers to subsequent proxy hosts.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse"
},
{
"cve": "CVE-2026-8674",
"cwe": {
"id": "CWE-1025",
"name": "Comparison Using Wrong Factors"
},
"discovery_date": "2026-09-17T17:32:44.409021+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536382"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the GNU C Library (glibc) DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from /etc/resolv.conf or the LOCALDOMAIN environment variable, it triggers an assertion failure, which aborts the process. This can be exploited without privileges on the target system, potentially through network configuration mechanisms like DHCP or a VPN server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw of MODERATE severity was found in the glibc (GNU C Library) DNS stub resolver, affecting Red Hat Enterprise Linux 8, 9, and 10, Red Hat OpenShift Container Platform releases built on RHEL CoreOS, and Red Hat Hardened Images. Initializing the stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more triggers an assertion failure that aborts the process, causing a denial of service. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Because search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software; confidentiality and integrity are not impacted. Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support (both glibc and compat-glibc) are not affected because the vulnerable code, introduced upstream in glibc 2.26, is not present in those versions. For the primary supported Red Hat Enterprise Linux update streams and Red Hat Hardened Images, fixes are being pursued through the responsible product streams. For the OpenShift Container Platform (RHCOS-based) streams and certain older Red Hat Enterprise Linux minor streams, the fix is deferred because the impact is MODERATE with a CVSS 3.1 score of 5.3, below the threshold at which Red Hat files updates for those streams; the residual risk is that an adjacent-network attacker able to influence resolver configuration could crash name-resolving processes on affected hosts. Red Hat\u0027s severity assessment matches the upstream rating (CVSS 3.1 score 5.3, MODERATE).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8674"
},
{
"category": "external",
"summary": "RHBZ#2536382",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536382"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8674",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8674"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8674",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8674"
},
{
"category": "external",
"summary": "https://joshua.hu/fuzzing-glibc-libresolv",
"url": "https://joshua.hu/fuzzing-glibc-libresolv"
},
{
"category": "external",
"summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=31026",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=31026"
},
{
"category": "external",
"summary": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021",
"url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021"
},
{
"category": "external",
"summary": "https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a",
"url": "https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a"
}
],
"release_date": "2026-09-17T16:54:27.310000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration"
},
{
"cve": "CVE-2026-10536",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-07-03T07:01:35.911244+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496766"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcurl. This use-after-free vulnerability occurs when an application configures an HTTP/2 stream-dependency tree and then performs a sequence of operations involving `curl_easy_reset()` and `curl_easy_cleanup()`. During the final cleanup, libcurl attempts to access memory that has already been released. This can lead to application crashes, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact use-after-free flaw in libcurl can lead to application crashes and Denial of Service. It occurs when an application specifically configures an HTTP/2 stream-dependency tree and then performs a precise sequence of `curl_easy_reset()` and `curl_easy_cleanup()` operations, attempting to access already freed memory. This vulnerability requires a specific application programming pattern, limiting its exploitability in typical Red Hat deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10536"
},
{
"category": "external",
"summary": "RHBZ#2496766",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496766"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10536"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10536",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10536"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-10536.html",
"url": "https://curl.se/docs/CVE-2026-10536.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-10536.json",
"url": "https://curl.se/docs/CVE-2026-10536.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3751697",
"url": "https://hackerone.com/reports/3751697"
}
],
"release_date": "2026-07-03T06:11:15.378000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid configuring HTTP/2 stream dependencies within applications utilizing libcurl. This functionality is considered deprecated and its use is required to trigger the vulnerability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service"
},
{
"cve": "CVE-2026-18374",
"cwe": {
"id": "CWE-134",
"name": "Use of Externally-Controlled Format String"
},
"discovery_date": "2026-08-27T20:19:54.467518+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2525256"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the GNU C Library (glibc). This vulnerability could allow an attacker with local access to trigger a heap buffer overflow by manipulating how the `fopen` function handles certain input. This could lead to minor disruptions in system operations or limited access to sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in glibc involves a heap buffer overflow when the `fopen` function processes an attacker-controlled mode string with an effectively empty `,ccs=` extension. Exploitation is highly complex as this specific usage pattern is not common in applications within typical Red Hat Enterprise Linux environments, significantly limiting its practical applicability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18374"
},
{
"category": "external",
"summary": "RHBZ#2525256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525256"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18374"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18374",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18374"
},
{
"category": "external",
"summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=34574",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34574"
},
{
"category": "external",
"summary": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015",
"url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015"
}
],
"release_date": "2026-08-27T19:20:40.426000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string"
},
{
"cve": "CVE-2026-19445",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-09-30T16:44:14.851300+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544138"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python. A remote, unauthenticated TLS client can cause a use-after-free in a server that uses SSLContext.sni_callback to assign a different SSLSocket.context when selecting a certificate per server name, if nothing else keeps the original SSLContext alive. This can crash the server process or result in a call through a freed pointer. Servers that wrap their listening socket with a long-lived SSLContext are not affected. TLS clients are not affected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: Use-after-free of a server-side SSLContext when sni_callback switches contexts",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Important. A remote unauthenticated client can trigger a server-side use-after-free when SNI callback code switches SSLSocket.context and drops the last reference to the original SSLContext, which can crash the process or call through a freed pointer (C:H/I:H/A:H). It is not Critical: exploitation requires a specific, non-default server pattern (per-connection or replaced SSLContext with sni_callback); the common pattern of wrapping the listening socket is explicitly not affected, so Attack Complexity is High. Red Hat ASLR, NX, and glibc heap hardening raise the bar for reliable code execution from the UAF but do not remove the crash/DoS impact, so Availability remains High.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19445"
},
{
"category": "external",
"summary": "RHBZ#2544138",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544138"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19445"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19445",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19445"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/156293",
"url": "https://github.com/python/cpython/issues/156293"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/158504",
"url": "https://github.com/python/cpython/pull/158504"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/"
}
],
"release_date": "2026-09-30T16:16:04.923000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "Restrict Python TLS servers that use SSLContext.sni_callback to trusted clients. Keep a strong reference to every SSLContext that registers an SNI callback for the lifetime of the server so the original context cannot be garbage-collected while connections remain open. Prefer wrapping the listening socket with a long-lived SSLContext; that common pattern is not affected. Host heap allocator hardening increases the difficulty of turning the use-after-free into reliable code execution but does not prevent process crashes.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: Use-after-free of a server-side SSLContext when sni_callback switches contexts"
},
{
"cve": "CVE-2026-19553",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2026-09-30T16:41:50.203373+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544127"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python. When establishing secure connections using the SSLContext.wrap_bio() function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rather than triggering an error. A remote man-in-the-middle attacker could exploit this defect to spoof trusted endpoints and intercept or tamper with sensitive encrypted traffic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Important because a man-in-the-middle attacker can cause Python clients using SSLContext.wrap_bio() (or asyncio TLS helpers that call it) to skip certificate hostname verification when check_hostname is enabled but server_hostname is omitted or empty, compromising confidentiality and integrity of the TLS session (C:H/I:H). It is not Critical: exploitation requires an on-path attacker and that specific API misuse (AC:H).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19553"
},
{
"category": "external",
"summary": "RHBZ#2544127",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544127"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19553"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19553",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19553"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/156793",
"url": "https://github.com/python/cpython/issues/156793"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/158503",
"url": "https://github.com/python/cpython/pull/158503"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/"
}
],
"release_date": "2026-09-30T16:17:39.368000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "Restrict Python TLS clients to trusted networks so an on-path attacker cannot intercept sessions. Applications that use SSLContext.wrap_bio(), asyncio.create_connection(), or loop.start_tls() with check_hostname enabled must pass a non-empty server_hostname; hostname verification then proceeds and this flaw is not reachable. Optionally pin expected server certificates so a mismatched host certificate is rejected even if hostname checking is skipped.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()"
},
{
"cve": "CVE-2026-19953",
"cwe": {
"id": "CWE-838",
"name": "Inappropriate Encoding for Output Context"
},
"discovery_date": "2026-08-31T20:21:16.490285+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2526492"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the URI component for Perl. This vulnerability occurs because the `nameprep` function, responsible for encoding hostnames, does not properly normalize Unicode characters. As a result, a hostname that is not in a standard Unicode form (non-NFC) can be encoded into a non-standard label. This discrepancy can lead to a situation where security checks, such as allow lists or Server-Side Request Forgery (SSRF) filters, may incorrectly process hostnames, potentially allowing an attacker to bypass security restrictions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a pure logic bypass (CWE-1289), not a memory safety vulnerability. Successful exploitation requires a very specific, multi-condition application pattern: (1) the application accepts a URL from untrusted network input; (2) it parses the URL with `URI-\u003enew()`; (3) it extracts the hostname via `-\u003ehost()` and uses it for a security decision (e.g., SSRF filtering); and (4) it separately fetches the URL with a client that performs correct IDNA normalization. Only when all four conditions are simultaneously true can an attacker bypass the security control.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19953"
},
{
"category": "external",
"summary": "RHBZ#2526492",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526492"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19953",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19953"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19953",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19953"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/08/31/14",
"url": "http://www.openwall.com/lists/oss-security/2026/08/31/14"
},
{
"category": "external",
"summary": "https://github.com/libwww-perl/URI/commit/956619a9e94f86d8d2c529b4e06a3674c54a73e7.patch",
"url": "https://github.com/libwww-perl/URI/commit/956619a9e94f86d8d2c529b4e06a3674c54a73e7.patch"
},
{
"category": "external",
"summary": "https://github.com/libwww-perl/URI/pull/191",
"url": "https://github.com/libwww-perl/URI/pull/191"
},
{
"category": "external",
"summary": "https://metacpan.org/release/OALDERS/URI-5.36/changes",
"url": "https://metacpan.org/release/OALDERS/URI-5.36/changes"
},
{
"category": "external",
"summary": "https://www.rfc-editor.org/rfc/rfc5891#section-5.2",
"url": "https://www.rfc-editor.org/rfc/rfc5891#section-5.2"
}
],
"release_date": "2026-08-31T17:29:42.929000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization"
},
{
"acknowledgments": [
{
"organization": "Aisle Research",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-77117",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-08-25T08:33:18.006000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2523274"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: Non-progress DoS in SHIFT_JISX0213 -\u0026gt",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact flaw in glibc\u0027s SHIFT_JISX0213 to UCS-4 conversion can lead to a denial of service. Exploitation requires an attacker to provide specially crafted input that an application converts using this specific path, triggering a 2-byte sequence and a caller that retries after an E2BIG error with insufficient output space. Red Hat products are only affected if they utilize this uncommon conversion path and exhibit the described retry behavior.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-77117"
},
{
"category": "external",
"summary": "RHBZ#2523274",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523274"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-77117",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77117"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77117",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77117"
}
],
"release_date": "2026-08-25T08:36:10.013000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "Do not convert untrusted input using the SHIFT_JISX0213 character set (for example via iconv). Where conversion cannot be avoided, apply process CPU time limits and container cgroup resource limits so a hung converter cannot exhaust host resources.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: Non-progress DoS in SHIFT_JISX0213 -\u0026gt"
},
{
"acknowledgments": [
{
"organization": "Aisle Research",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-80489",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-08-27T08:47:55.722000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2524870"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in glibc. Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding (for example with iconv) can cause the converter to make no progress, hanging the calling application. Some EUC_JISX0213 sequences decode to two code points; if the output buffer has room for only the first, the second is stored in conversion state and returned as E2BIG, but that pending character is never cleared after it is emitted on the next call, so retries loop forever without consuming further input.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: Non-progress DoS in EUC_JISX0213 -\u003e UCS-4 conversion state",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate denial-of-service flaw in glibc\u0027s EUC_JISX0213 to UCS-4 conversion requires attacker-controlled input on that uncommon charset path and an application that retries conversion with an output buffer small enough to split a two-code-point sequence. Impact is limited to process hang (availability only). The related SHIFT_JISX0213 defect is tracked separately as CVE-2026-77117.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-80489"
},
{
"category": "external",
"summary": "RHBZ#2524870",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524870"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-80489",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80489"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80489",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80489"
}
],
"release_date": "2026-08-27T08:49:17.578000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "To mitigate this avoid converting untrusted data with that charset, or disable the conversion path if unused. Where conversion of untrusted input cannot be avoided, restrict access to trusted clients and apply process CPU/resource limits to contain hang impact.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: Non-progress DoS in EUC_JISX0213 -\u003e UCS-4 conversion state"
},
{
"cve": "CVE-2026-89156",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-11T04:20:54.923994+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531743"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PCRE2. An attacker can provide invalid UTF (Unicode Transformation Format) data, leading to an out-of-bounds read during a Just-In-Time (JIT) fallback. This vulnerability could potentially result in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An out-of-bounds read can occur in PCRE2 when processing specially crafted invalid UTF data during a JIT fallback. Exploitation requires an application using PCRE2 to process untrusted input with JIT enabled, which may lead to a denial of service or information disclosure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89156"
},
{
"category": "external",
"summary": "RHBZ#2531743",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531743"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89156",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89156"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89156",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89156"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x",
"url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"
}
],
"release_date": "2026-09-11T04:03:05.876000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 2.9,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback"
},
{
"cve": "CVE-2026-89157",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-11T04:20:57.926410+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531744"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PCRE2. On 32-bit platforms, an attacker can provide a specially crafted large pattern, leading to an out-of-bounds write within the pcre2_pattern_convert function. This vulnerability can result in high integrity impact, such as data corruption, and potentially a low availability impact, causing a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pcre2: PCRE2: Out-of-bounds write via large pattern input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This out-of-bounds write vulnerability in PCRE2 on 32-bit platforms could lead to data corruption with high integrity impact and potential denial of service. Exploitation requires an attacker to provide a specially crafted large pattern, but no privileges or user interaction are needed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89157"
},
{
"category": "external",
"summary": "RHBZ#2531744",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531744"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89157"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89157",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89157"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9",
"url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"
}
],
"release_date": "2026-09-11T04:05:27.069000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "pcre2: PCRE2: Out-of-bounds write via large pattern input"
},
{
"cve": "CVE-2026-89158",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-11T04:21:03.968148+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531746"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PCRE2. On 32-bit platforms, an integer overflow in the `pcre2_compile_32` function can lead to an out-of-bounds write. This vulnerability could allow a remote attacker to achieve a high integrity impact and a low availability impact, potentially leading to data corruption or denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A Moderate impact flaw was found in PCRE2 affecting 32-bit platforms, where an integer overflow in the `pcre2_compile_32` function can lead to an out-of-bounds write. While exploitable over the network without requiring user interaction or privileges, the high attack complexity reduces its overall severity. Successful exploitation could result in high integrity impact, such as data corruption, or a low availability impact, leading to a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89158"
},
{
"category": "external",
"summary": "RHBZ#2531746",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531746"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89158"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89158",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89158"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859",
"url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859"
}
],
"release_date": "2026-09-11T04:07:21.973000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms"
},
{
"cve": "CVE-2026-89160",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-11T04:21:00.943707+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531745"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PCRE2, a library for processing regular expressions. A remote attacker could exploit this vulnerability by providing a specially crafted input that triggers an out-of-bounds read during pattern matching with invalid UTF (Unicode Transformation Format) characters. This could lead to a denial of service, making the affected system or application unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Low impact. A denial of service could occur in applications utilizing PCRE2 for regular expression matching if specially crafted invalid UTF input is processed. The high attack complexity required to trigger this out-of-bounds read limits its overall impact on Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89160"
},
{
"category": "external",
"summary": "RHBZ#2531745",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531745"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89160",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89160"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89160",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89160"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq",
"url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq"
}
],
"release_date": "2026-09-11T04:09:06.527000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching"
},
{
"cve": "CVE-2026-89161",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-09-11T04:21:06.963234+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531747"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important memory corruption vulnerability in PCRE2\u0027s JIT compiler. An attacker could exploit a flaw in `pcre2_jit_match` when a previously copied subject is passed as context, potentially leading to arbitrary code execution or denial of service. The high attack complexity and local attack vector reduce the overall risk, but the widespread use of PCRE2 and the potential for severe impact warrant the Important classification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89161"
},
{
"category": "external",
"summary": "RHBZ#2531747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89161",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89161"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/pull/937",
"url": "https://github.com/PCRE2Project/pcre2/pull/937"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
}
],
"release_date": "2026-09-11T04:11:51.666000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match"
},
{
"cve": "CVE-2026-103111",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-30T04:40:56.869940+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2543797"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact because applications that compile untrusted regular expressions using PCRE2 Just-In-Time (JIT) execution interfaces may allow memory corruption and arbitrary code execution. The risk is primarily confined to specific custom applications or specialized network services that process external regular expressions using vulnerable JIT routines.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-103111"
},
{
"category": "external",
"summary": "RHBZ#2543797",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543797"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-103111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-103111"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m",
"url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m"
}
],
"release_date": "2026-09-30T04:13:59.115000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T19:53:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87400"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Cost Management On-Premise 1:registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.