{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana13.1:\n  * grafana13.1-13.1.8-0.5.hum1 (aarch64, s390x, x86_64)\n  * grafana13.1-13.1.8-0.5.hum1.src (src)\n\nSecurity Fix(es):\n\ngrafana13.1:\n  * CVE-2026-111181\n  * CVE-2026-110306\n  * CVE-2026-110180\n  * CVE-2026-110095\n  * CVE-2026-110725",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:91181",
        "url": "https://access.redhat.com/errata/RHSA-2026:91181"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-110095",
        "url": "https://access.redhat.com/security/cve/CVE-2026-110095"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-110180",
        "url": "https://access.redhat.com/security/cve/CVE-2026-110180"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-110306",
        "url": "https://access.redhat.com/security/cve/CVE-2026-110306"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-110725",
        "url": "https://access.redhat.com/security/cve/CVE-2026-110725"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-111181",
        "url": "https://access.redhat.com/security/cve/CVE-2026-111181"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-16491",
        "url": "https://access.redhat.com/security/cve/CVE-2026-16491"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-103506",
        "url": "https://access.redhat.com/security/cve/CVE-2026-103506"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-79656",
        "url": "https://access.redhat.com/security/cve/CVE-2026-79656"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_91181.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-11-01T05:18:09+00:00",
      "generator": {
        "date": "2026-11-01T05:18:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:91181",
      "initial_release_date": "2026-10-27T18:14:33+00:00",
      "revision_history": [
        {
          "date": "2026-10-27T18:14:33+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-29T14:02:33+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-01T05:18:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.1-0:13.1.8-0.5.hum1@aarch64",
                "product": {
                  "name": "grafana13.1-0:13.1.8-0.5.hum1@aarch64",
                  "product_id": "grafana13.1-0:13.1.8-0.5.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.8-0.5.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.1-0:13.1.8-0.5.hum1@s390x",
                "product": {
                  "name": "grafana13.1-0:13.1.8-0.5.hum1@s390x",
                  "product_id": "grafana13.1-0:13.1.8-0.5.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.8-0.5.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.1-0:13.1.8-0.5.hum1@src",
                "product": {
                  "name": "grafana13.1-0:13.1.8-0.5.hum1@src",
                  "product_id": "grafana13.1-0:13.1.8-0.5.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.8-0.5.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.1-0:13.1.8-0.5.hum1@x86_64",
                "product": {
                  "name": "grafana13.1-0:13.1.8-0.5.hum1@x86_64",
                  "product_id": "grafana13.1-0:13.1.8-0.5.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.8-0.5.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.1-0:13.1.8-0.5.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64"
        },
        "product_reference": "grafana13.1-0:13.1.8-0.5.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.1-0:13.1.8-0.5.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x"
        },
        "product_reference": "grafana13.1-0:13.1.8-0.5.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.1-0:13.1.8-0.5.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src"
        },
        "product_reference": "grafana13.1-0:13.1.8-0.5.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.1-0:13.1.8-0.5.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
        },
        "product_reference": "grafana13.1-0:13.1.8-0.5.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-79656",
      "cwe": {
        "id": "CWE-256",
        "name": "Plaintext Storage of a Password"
      },
      "discovery_date": "2026-09-04T16:19:20.134000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528700"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. When a user signs in using generic OAuth, Google, or GitLab single sign-on connectors, Grafana may write the user\u0027s OAuth or OpenID Connect (OIDC) tokens to its server logs in plaintext. This occurs if the identity provider returns an opaque token or if token parsing fails. A local attacker with read access to the Grafana server logs could recover these live credentials, which are scoped to the Grafana OAuth client. This vulnerability is not remotely exploitable and does not directly lead to account takeover.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: OAuth and OIDC tokens written unredacted to Grafana server logs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated Moderate because it requires local access to Grafana server logs to exploit. While sensitive OAuth and OIDC tokens may be written to logs under specific SSO configurations, the vulnerability is not remotely exploitable, and the impact is limited by the scopes granted to the Grafana OAuth client, preventing direct account takeover.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-79656"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528700",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528700"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-79656",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-79656"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-79656",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79656"
        }
      ],
      "release_date": "2026-10-29T13:02:28.194000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:14:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91181"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict read access to Grafana server logs and any downstream log pipelines. Additionally, minimize the scopes granted to the Grafana OAuth client to limit the potential impact of leaked tokens. If your identity provider issues long-lived or non-expiring tokens, consider rotating the Grafana OAuth client secret and revoking issued tokens at the provider.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: OAuth and OIDC tokens written unredacted to Grafana server logs"
    },
    {
      "cve": "CVE-2026-103506",
      "cwe": {
        "id": "CWE-425",
        "name": "Direct Request"
      },
      "discovery_date": "2026-10-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2554120"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. When the experimental Kubernetes Single Sign-On (SSO) settings Application Programming Interface (API) feature toggle is enabled, the service fails to enforce proper authorization checks. An authenticated user with low-privilege Viewer permissions can exploit this vulnerability to view sensitive SSO client secrets and modify authentication settings.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: SSO secrets readable by low-privileged users when an experimental feature is enabled",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important impact because authenticated users possessing minimal viewer privileges can expose sensitive single sign-on credentials and modify authentication configurations across the platform. Such credential exposure may allow attackers to compromise downstream identity providers or escalate access within the organization. However, the risk is constrained in standard Red Hat environments because the affected API relies on an experimental feature toggle that remains deactivated by default.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-103506"
        },
        {
          "category": "external",
          "summary": "RHBZ#2554120",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554120"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-103506",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-103506"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-103506",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103506"
        }
      ],
      "release_date": "2026-10-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:14:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91181"
        },
        {
          "category": "workaround",
          "details": "Ensure the experimental `kubernetesSsoSettingsApi` feature toggle is disabled. By default, this feature toggle is inactive. If this feature was manually activated, remove `kubernetesSsoSettingsApi` from the `[feature_toggles]` section in the Grafana configuration file (`grafana.ini`) or from the `GF_FEATURE_TOGGLES_ENABLE` environment variable.\n\nApply the configuration by restarting the service:\n```\nsystemctl restart grafana-server\n```\n\nWarning: Restarting the `grafana-server` service will result in a temporary interruption of service for connected users. Additionally, if the toggle was previously enabled, immediately rotate all associated SSO client secrets to prevent unauthorized access from potentially exposed credentials.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grafana: SSO secrets readable by low-privileged users when an experimental feature is enabled"
    },
    {
      "cve": "CVE-2026-110095",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory"
      },
      "discovery_date": "2026-10-20T07:00:55.676503+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556002"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. The library improperly applies dot-segment removal to relative Uniform Resource Identifier (URI) paths during normalization, causing leading parent-directory segments to be discarded. A remote attacker could supply a crafted relative path to an application that relies on fast-uri for resolution, caching, or authorization. This can cause the reference to escape its intended directory, potentially allowing unauthorized access to restricted resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Path traversal via improper relative URI normalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having a Low impact because exploitation requires an application to specifically pass untrusted relative paths to URI normalization or serialization routines prior to base resolution or access control checks. Within Red Hat products, fast-uri is primarily present as an indirect dependency in web consoles, dashboard interfaces, and frontend tooling. Typical product deployments do not expose authorization or routing workflows that rely on standalone relative URI normalization of untrusted input, substantially limiting the attack surface.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110095"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556002",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556002"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110095",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110095"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110095",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110095"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h"
        }
      ],
      "release_date": "2026-10-20T06:56:56.456000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:14:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91181"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "fast-uri: fast-uri: Path traversal via improper relative URI normalization"
    },
    {
      "cve": "CVE-2026-110180",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-10-20T07:21:50.840605+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556008"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. When processing web addresses, the host canonicalization mechanism can silently strip control characters or drop user information without verifying that the full host input was consumed. A remote attacker can exploit this parsing discrepancy by supplying a specially crafted address to bypass host-based security policies, such as domain blocklists, redirect validations, or proxy routing rules. As a result, applications may inadvertently direct network requests to unintended destinations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Security policy bypass via improper host canonicalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate severity because exploitation requires a specific application architecture where host-based access controls or redirection boundaries rely directly on fast-uri parsing of untrusted network input. Because successful manipulation only allows bypassing host filters or redirecting traffic rather than granting arbitrary code execution, the overall blast radius remains constrained. In Red Hat environments, the affected Node.js package is primarily distributed as an embedded dependency within web applications and plugins, meaning the risk is contingent upon whether the consuming service exposes URL canonicalization to external users.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110180"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556008",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556008"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110180",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110180"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110180",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110180"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr"
        }
      ],
      "release_date": "2026-10-20T07:00:42.153000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:14:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91181"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "fast-uri: fast-uri: Security policy bypass via improper host canonicalization"
    },
    {
      "cve": "CVE-2026-110306",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-10-20T07:21:28.248626+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556005"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. The library incorrectly decodes percent-encoded characters in protocol schemes prior to validation, causing invalid or prohibited schemes to be accepted as valid. A remote attacker can exploit this vulnerability by submitting a specially crafted Uniform Resource Identifier (URI) to bypass application allowlists, potentially leading to Cross-Site Scripting (XSS) if the normalized output is rendered in a web browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact for Red Hat products because successful exploitation requires user interaction to execute cross-site scripting in a browser and does not permit direct server-side compromise or privilege escalation. The flaw affects application environments that rely on fast-uri to parse and normalize untrusted URIs without performing downstream output sanitization. In many Red Hat web user interfaces and console plugins, overall exposure is further constrained by framework-level sanitization and browser security controls such as Content Security Policy.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110306"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556005",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556005"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110306",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110306"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110306",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110306"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg"
        }
      ],
      "release_date": "2026-10-20T07:03:47.312000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:14:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91181"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding"
    },
    {
      "cve": "CVE-2026-110725",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation"
      },
      "discovery_date": "2026-10-20T07:21:44.951200+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556007"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. A remote attacker could exploit this vulnerability to trigger cross-site scripting (XSS) by providing crafted input to applications that serialize or normalize relative Uniform Resource Identifiers (URIs) using the suffix reference option. Because the library fails to properly escape colons in the first path segment of relative paths, the generated string can be misinterpreted by downstream components as an absolute URI with an executable scheme.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having a Low impact because exploitation is constrained to applications invoking specific non-default parsing configurations on untrusted input without scheme authority. Across Red Hat products, this library is primarily embedded as an internal dependency within build pipelines and administrative web consoles, where user-controlled relative URIs are not handled using this specialized setting. Consequently, the likelihood of triggering cross-site scripting or URI misinterpretation in default deployments is minimal.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110725"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556007",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556007"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110725",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110725"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110725",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110725"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp"
        }
      ],
      "release_date": "2026-10-20T07:06:29.946000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:14:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91181"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths"
    },
    {
      "cve": "CVE-2026-111181",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-10-22T14:41:42.751154+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2559049"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in body-parser. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by sending a specially crafted HTTP request with compressed content containing unexpected trailing data. Because the application fails to handle decompression stream errors after processing the initial compressed content, the trailing data triggers an uncaught exception that terminates the server process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "body-parser: body-parser: Denial of Service via unhandled decompression stream error",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity because an unauthenticated remote attacker can crash the entire application process, leading to a complete denial of service. Applications that rely on default body-parser configurations automatically decompress incoming request bodies before route matching and authentication are executed. As a result, any exposed endpoint accepting body data can be exploited without privileges, causing an uncaught stream exception that terminates the Node.js runtime.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-111181"
        },
        {
          "category": "external",
          "summary": "RHBZ#2559049",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559049"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-111181",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-111181"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111181",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111181"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828",
          "url": "https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"
        }
      ],
      "release_date": "2026-10-22T14:29:56.577000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:14:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91181"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.5.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error"
    }
  ]
}