RHSA-2026:91967
Vulnerability from csaf_redhat - Published: 2026-10-28 15:54 - Updated: 2026-10-30 13:12Summary
Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage
Severity
Important
Notes
Topic: A Subscription Management tool for finding and reporting Red Hat product usage
Details: Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds,
identifies, and reports environment data, or facts, such as the number of physical and virtual
systems on a network, their operating systems, and relevant configuration data stored within
them. Discovery also identifies and reports more detailed facts for some versions of key
Red Hat packages and products that it finds in the network.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in React Router. This vulnerability, a type of Cross-Site Scripting (XSS), affects applications utilizing React Router's unstable React Server Components (RSC) APIs. A remote attacker could exploit this by sending untrusted redirects, leading to the execution of malicious scripts in the client's browser. This could result in information disclosure or unauthorized actions.
4.2 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in source-map-js. This vulnerability allows a remote attacker to trigger a denial of service by providing malformed input. Specifically, by supplying extremely large offset line values in indexed source maps, the attacker can cause the service's event loop to block, making it unable to process further requests.
7.5 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-33245
Known not affected
2 products, the same list as for
CVE-2026-33245
Threats
Impact
Important
A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-33245
Known not affected
2 products, the same list as for
CVE-2026-33245
Threats
Impact
Important
A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the application to crash.
6.5 (Medium)
Affected products
Fixed
2 products, the same list as for
CVE-2026-33245
Known not affected
2 products, the same list as for
CVE-2026-33245
Threats
Impact
Important
A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered, causing any following text on new lines to be executed as shell commands by the underlying system.
8.1 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-33245
Known not affected
2 products, the same list as for
CVE-2026-33245
Threats
Impact
Important
A flaw was found in probe-image-size. An unauthenticated remote attacker can exploit this vulnerability to cause a Denial of Service (DoS) by supplying specially crafted Scalable Vector Graphics (SVG) input. Due to inefficient pattern matching and input handling during SVG parsing, processing unclosed tags can consume excessive CPU resources and block the application event loop, leaving the service unresponsive.
7.5 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-33245
Known not affected
2 products, the same list as for
CVE-2026-33245
Threats
Impact
Important
A flaw was found in aiohttp. The server does not enforce a timeout during the initial phase of a request before any data is received. A remote attacker can exploit this vulnerability by keeping idle connections open indefinitely, exhausting available connection capacity and resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in aiohttp. When processing multipart requests, the framework fails to properly limit the number of open file descriptors retained during request handling. An unauthenticated remote attacker can exploit this issue by sending specially crafted multipart requests, exhausting available file descriptors and causing a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111064
Known not affected
2 products, the same list as for
CVE-2026-111064
Threats
Impact
Important
References
72 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A Subscription Management tool for finding and reporting Red Hat product usage",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds,\nidentifies, and reports environment data, or facts, such as the number of physical and virtual\nsystems on a network, their operating systems, and relevant configuration data stored within\nthem. Discovery also identifies and reports more detailed facts for some versions of key\nRed Hat packages and products that it finds in the network.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:91967",
"url": "https://access.redhat.com/errata/RHSA-2026:91967"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-102276",
"url": "https://access.redhat.com/security/cve/CVE-2026-102276"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-102278",
"url": "https://access.redhat.com/security/cve/CVE-2026-102278"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-102422",
"url": "https://access.redhat.com/security/cve/CVE-2026-102422"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-104861",
"url": "https://access.redhat.com/security/cve/CVE-2026-104861"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-111064",
"url": "https://access.redhat.com/security/cve/CVE-2026-111064"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-111066",
"url": "https://access.redhat.com/security/cve/CVE-2026-111066"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33245",
"url": "https://access.redhat.com/security/cve/CVE-2026-33245"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-93749",
"url": "https://access.redhat.com/security/cve/CVE-2026-93749"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/subscription_central/1-latest/#Discovery",
"url": "https://docs.redhat.com/en/documentation/subscription_central/1-latest/#Discovery"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_91967.json"
}
],
"title": "Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage",
"tracking": {
"current_release_date": "2026-10-30T13:12:28+00:00",
"generator": {
"date": "2026-10-30T13:12:28+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHSA-2026:91967",
"initial_release_date": "2026-10-28T15:54:09+00:00",
"revision_history": [
{
"date": "2026-10-28T15:54:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-28T15:54:11+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-30T13:12:28+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Discovery 2",
"product": {
"name": "Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:discovery:2::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Discovery"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"product": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"product_id": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-server-rhel9@sha256%3A1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf?arch=amd64\u0026repository_url=registry.redhat.io/discovery/discovery-server-rhel9\u0026tag=1792604013"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"product": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"product_id": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-ui-rhel9@sha256%3A69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc?arch=amd64\u0026repository_url=registry.redhat.io/discovery/discovery-ui-rhel9\u0026tag=1792603924"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"product": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"product_id": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-server-rhel9@sha256%3Ac557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43?arch=arm64\u0026repository_url=registry.redhat.io/discovery/discovery-server-rhel9\u0026tag=1792604013"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64",
"product": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64",
"product_id": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-ui-rhel9@sha256%3Aea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47?arch=arm64\u0026repository_url=registry.redhat.io/discovery/discovery-ui-rhel9\u0026tag=1792603924"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64 as a component of Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64"
},
"product_reference": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"relates_to_product_reference": "Red Hat Discovery 2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64 as a component of Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
},
"product_reference": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"relates_to_product_reference": "Red Hat Discovery 2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64 as a component of Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64"
},
"product_reference": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"relates_to_product_reference": "Red Hat Discovery 2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64 as a component of Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
},
"product_reference": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64",
"relates_to_product_reference": "Red Hat Discovery 2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-33245",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-06-02T20:02:35.251282+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484124"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in React Router. This vulnerability, a type of Cross-Site Scripting (XSS), affects applications utilizing React Router\u0027s unstable React Server Components (RSC) APIs. A remote attacker could exploit this by sending untrusted redirects, leading to the execution of malicious scripts in the client\u0027s browser. This could result in information disclosure or unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "react-router: React Router: Cross-Site Scripting vulnerability via untrusted React Server Component redirects",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate impact for Red Hat products because successful exploitation requires an application to implement experimental React Server Components features alongside unvalidated external navigation targets. Red Hat web applications and management consoles typically utilize standard routing interfaces and do not consume arbitrary, user-controlled navigation paths within server-driven components. Consequently, supported deployments are not exposed to client-side script execution through this vector under typical usage.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33245"
},
{
"category": "external",
"summary": "RHBZ#2484124",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484124"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33245",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33245"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33245",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33245"
},
{
"category": "external",
"summary": "https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62",
"url": "https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62"
}
],
"release_date": "2026-06-02T17:14:50.377000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-28T15:54:09+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91967"
},
{
"category": "workaround",
"details": "To mitigate this Cross-Site Scripting (XSS) vulnerability, ensure that applications utilizing React Router\u0027s unstable React Server Components (RSC) APIs only process redirects from trusted sources. Avoiding the use of these unstable APIs in production environments where untrusted redirect sources cannot be guaranteed is also recommended.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "react-router: React Router: Cross-Site Scripting vulnerability via untrusted React Server Component redirects"
},
{
"cve": "CVE-2026-93749",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-09-22T18:17:34.349880+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2538368"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in source-map-js. This vulnerability allows a remote attacker to trigger a denial of service by providing malformed input. Specifically, by supplying extremely large offset line values in indexed source maps, the attacker can cause the service\u0027s event loop to block, making it unable to process further requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "source-map-js: source-map-js: Denial of Service via malformed indexed source maps",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an unauthenticated remote attacker can supply crafted data that synchronously blocks the single-threaded event loop, resulting in a sustained denial of service for affected services. In standard Red Hat application environments, source map parsing utilities are predominantly utilized in build systems or developer tooling rather than production-facing services, which limits general exposure. However, server-side applications accepting and processing untrusted source maps from external clients are directly susceptible to availability disruption.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93749"
},
{
"category": "external",
"summary": "RHBZ#2538368",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538368"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93749",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93749"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93749",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93749"
},
{
"category": "external",
"summary": "https://github.com/7rulnik/source-map-js",
"url": "https://github.com/7rulnik/source-map-js"
},
{
"category": "external",
"summary": "https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118",
"url": "https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118"
},
{
"category": "external",
"summary": "https://github.com/7rulnik/source-map-js/issues/76",
"url": "https://github.com/7rulnik/source-map-js/issues/76"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service",
"url": "https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service"
}
],
"release_date": "2026-09-18T17:51:34.972000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-28T15:54:09+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91967"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "source-map-js: source-map-js: Denial of Service via malformed indexed source maps"
},
{
"cve": "CVE-2026-102276",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-28T21:02:20.910434+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2542707"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this vulnerability as Important because an unauthenticated remote attacker can crash running Node.js services by submitting malformed pattern strings, resulting in a denial of service. In Red Hat environments, applications that accept arbitrary glob or expansion patterns from external inputs are susceptible to unexpected termination due to an unhandled call stack overflow. While this flaw allows service interruption without requiring privileges, it does not lead to code execution or compromise data confidentiality and integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102276"
},
{
"category": "external",
"summary": "RHBZ#2542707",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542707"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102276"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102276",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102276"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"
}
],
"release_date": "2026-09-28T20:50:59.984000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-28T15:54:09+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91967"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns"
},
{
"cve": "CVE-2026-102278",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-28T21:00:55.949756+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2542700"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the application to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because remote unauthenticated attackers can supply crafted nested expressions to trigger native stack exhaustion and crash server-side processes, resulting in a denial of service without compromising system confidentiality or integrity. In Red Hat environments, the affected library is distributed across containerized web consoles, developer tools, and Node.js runtime environments. Exploitation is constrained to deployments where applications process untrusted, user-defined pattern inputs directly through expansion functions without input depth validation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102278"
},
{
"category": "external",
"summary": "RHBZ#2542700",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542700"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102278",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102278"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102278",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102278"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"
}
],
"release_date": "2026-09-28T20:57:09.850000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-28T15:54:09+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91967"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns"
},
{
"cve": "CVE-2026-102422",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-09-29T04:01:43.300404+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2542933"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered, causing any following text on new lines to be executed as shell commands by the underlying system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Important. Exploitation leads to arbitrary command execution with the privileges of the calling application, but only when that application passes the output of shell-quote\u0027s parse(), combined with another attacker-controlled string, to quote() and then runs the result through a shell. Red Hat products ship shell-quote as a bundled npm dependency across several offerings, including RHEL (grafana, grafana-pcp, pcs), Red Hat Ansible Automation Platform, Red Hat OpenShift AI and middleware distributions. Whether a given product is exposed depends on whether its own code reaches quote() with attacker-influenced input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102422"
},
{
"category": "external",
"summary": "RHBZ#2542933",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542933"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102422"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102422",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102422"
},
{
"category": "external",
"summary": "https://github.com/ljharb/shell-quote",
"url": "https://github.com/ljharb/shell-quote"
},
{
"category": "external",
"summary": "https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc",
"url": "https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc"
},
{
"category": "external",
"summary": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv",
"url": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/shell-quote",
"url": "https://www.npmjs.com/package/shell-quote"
}
],
"release_date": "2026-09-29T03:47:36.376000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-28T15:54:09+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91967"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling"
},
{
"cve": "CVE-2026-104861",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-10-02T18:04:16.318434+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545307"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in probe-image-size. An unauthenticated remote attacker can exploit this vulnerability to cause a Denial of Service (DoS) by supplying specially crafted Scalable Vector Graphics (SVG) input. Due to inefficient pattern matching and input handling during SVG parsing, processing unclosed tags can consume excessive CPU resources and block the application event loop, leaving the service unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "probe-image-size: probe-image-size: Denial of Service via crafted SVG input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is classified as Moderate severity because an unauthenticated remote attacker supplying specially crafted SVG input can trigger inefficient parsing, resulting in excessive CPU consumption and a denial of service (DoS) by blocking the application event loop without enabling arbitrary code execution or data exposure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-104861"
},
{
"category": "external",
"summary": "RHBZ#2545307",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545307"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-104861",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-104861"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-104861",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104861"
},
{
"category": "external",
"summary": "https://github.com/nodeca/probe-image-size/commit/60cc96ac0b671e79e328213d0a8e831312b09e84",
"url": "https://github.com/nodeca/probe-image-size/commit/60cc96ac0b671e79e328213d0a8e831312b09e84"
},
{
"category": "external",
"summary": "https://github.com/nodeca/probe-image-size/commit/9b74656d6f973cc59ea2ab1375c0d88390a402ad",
"url": "https://github.com/nodeca/probe-image-size/commit/9b74656d6f973cc59ea2ab1375c0d88390a402ad"
},
{
"category": "external",
"summary": "https://github.com/nodeca/probe-image-size/commit/c032aefabdecf5cb50548ab9ba175db56353078f",
"url": "https://github.com/nodeca/probe-image-size/commit/c032aefabdecf5cb50548ab9ba175db56353078f"
},
{
"category": "external",
"summary": "https://github.com/nodeca/probe-image-size/releases/tag/7.4.0",
"url": "https://github.com/nodeca/probe-image-size/releases/tag/7.4.0"
},
{
"category": "external",
"summary": "https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc",
"url": "https://github.com/nodeca/probe-image-size/security/advisories/GHSA-gjj5-9665-rwrc"
}
],
"release_date": "2026-10-02T17:56:15.515000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-28T15:54:09+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91967"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "probe-image-size: probe-image-size: Denial of Service via crafted SVG input"
},
{
"cve": "CVE-2026-111064",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-10-19T17:02:11.133402+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2555713"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in aiohttp. The server does not enforce a timeout during the initial phase of a request before any data is received. A remote attacker can exploit this vulnerability by keeping idle connections open indefinitely, exhausting available connection capacity and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "aiohttp: aiohttp: Denial of Service via missing initial request timeout",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw affects products that run an aiohttp server exposed to untrusted clients. Products that use aiohttp only as an HTTP client are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-111064"
},
{
"category": "external",
"summary": "RHBZ#2555713",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555713"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-111064",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111064"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111064",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111064"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3",
"url": "https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4",
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3",
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3"
}
],
"release_date": "2026-10-19T16:47:35.036000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-28T15:54:09+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91967"
},
{
"category": "workaround",
"details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce initial keep-alive timeouts and first-request deadlines on newly established HTTP connections within aiohttp: upgrade to aiohttp 3.14.4 (or the fixed Ansible Automation Platform 24/Lightspeed Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Python3.11 Aiohttp/Koku/Exploit Intelligence/Vulnerability Analysis Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhaiis/Vllm Spyre Rhel/Rhaiis/Vllm Tpu Rhel/Cloudservices/Vulnerability Engine App/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 24/Controller Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Cloudservices/Insights Engine/Rhoai/Odh Ml Pipelines Runtime Generic Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Ta Lmes Job Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Automation Controller/Cloudservices/Floorist/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Model Registry Job Async Upload Rhel/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Rhoai/Odh Openvino Model Server Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Ask Sre/Rhelai3/Bootc Gaudi Rhel/Ansible Automation Platform Tech Preview/Ee Minimal Rhel/Rhoai/Odh Training Cuda121 Torch24 Py311 Rhel/Rhoai/Odh Training Cuda124 Torch25 Py311 Rhel/Rhoai/Odh Training Cuda128 Torch28 Py312 Rhel/Rhoai/Odh Training Rocm62 Torch24 Py311 Rhel/Rhoai/Odh Training Rocm62 Torch25 Py311 Rhel/Rhoai/Odh Training Rocm64 Torch28 Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Astro Virtual Assistant V/Lightspeed Core/Lightspeed Stack Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Mta/Mta Solution Server Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Mlserver Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Pipeline Runtime Minimal Cpu Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Minimal Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Minimal Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Minimal Rocm Py312 Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform 25/Controller Rhel/Ansible Automation Platform 25/Lightspeed Rhel/Ansible Automation Platform 26/Ansible Dev Tools Rhel/Ansible Automation Platform 26/Controller Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 26/De Supported Rhel/Ansible Automation Platform 26/Ee Minimal Rhel/Ansible Automation Platform 26/Ee Supported Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 26/Lightspeed Rhel/Ansible Automation Platform 26/Platform Resource Runner Rhel/Ansible Automation Platform 27/Controller Rhel/Ansible Automation Platform 27/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 27/Ee Control Plane Rhel/Ansible Automation Platform 27/Ee Minimal Rhel/Ansible Automation Platform 27/Ee Supported Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Lightspeed Rhel/Ansible Automation Platform 27/Platform Resource Runner Rhel/Ansible Automation Platform/Ee Minimal Rhel/Galaxy Ng/Automation Hub Container/Redhat User Workloads/Ansible Saas Ee/Ansible On Clouds/Gh Action Runner/Ansible Ai Connect Service/Insights Engine/Cloudservices/Subscription Central Automation/Google Lightspeed Agent/Lscore Deploy/Vulnerability Engine/Cloudservices/Sha Extractor/Lightspeed Core/Rag Tool Cpu Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Nlp Rhel/Rhoai/Odh Mlserver Cuda Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Discovery/Discovery Server Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gcp Cuda Rhel/Rhelai3/Bootc Rocm Rhel/Satellite/Iop Insights Engine Rhel/Satellite/Iop Vulnerability Engine Rhel/Python3.12 Aiohttp/Python Aiohttp/Insights Host Inventory/Aap Rag Content/Ansible Chatbot Stack/Aoc/Ee Aap Azure Sre/Ansible On Clouds/Aoc Utility/Redhat User Workloads/Release Service Utils Standalone/Lightspeed Services Ocp/Ocp Rules Rhel/App Sre/Managed Prometheus Exporter Initcontainer/App Sre/Managed Prometheus Exporter Base/Python3X Aiohttp builds), which schedule an initial keep-alive timeout check in connection_made() when keepalive_timeout is greater than zero, lower the default keepalive_timeout from 3630 to 75.0 seconds, and enforce a first-request deadline, closing all 2 injection vectors (idle TCP connections opened without sending request data, trickling partial request data before the first complete HTTP request). Until patched, this is a concern on aiohttp HTTP server deployments directly exposed to network traffic without intermediate timeout enforcement, so place aiohttp instances behind a reverse proxy that actively enforces connection read and idle timeouts before requests arrive. As a compensating measure, configure systemd WatchdogSec and automatic restart directives to monitor daemon responsiveness and restart the aiohttp service if connection exhaustion halts health checks. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing initial request timeout defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-906 Rate Limiting / Connection Throttling (high)",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "aiohttp: aiohttp: Denial of Service via missing initial request timeout"
},
{
"cve": "CVE-2026-111066",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-19T17:23:14.934493+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2555720"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in aiohttp. When processing multipart requests, the framework fails to properly limit the number of open file descriptors retained during request handling. An unauthenticated remote attacker can exploit this issue by sending specially crafted multipart requests, exhausting available file descriptors and causing a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important for Red Hat products because an unauthenticated remote attacker can cause a denial of service without requiring user interaction or elevated privileges. In Red Hat environments, exposure is limited to services or containerized applications built with the aiohttp framework that explicitly handle multipart form uploads. When such endpoints are targeted, excessive file handle consumption can exhaust operating system resources, preventing the affected service from handling legitimate requests.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-111066"
},
{
"category": "external",
"summary": "RHBZ#2555720",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555720"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-111066",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111066"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111066",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111066"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09",
"url": "https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4",
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg",
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg"
}
],
"release_date": "2026-10-19T16:59:47.217000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-28T15:54:09+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:91967"
},
{
"category": "workaround",
"details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce strict limits on multipart payload sizes and uploaded part counts in request handlers invoking Request.post() to prevent unbounded file descriptor allocation: upgrade to aiohttp 3.14.4 (or the fixed Ansible Automation Platform 24/Lightspeed Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Python3.11 Aiohttp/Koku/Exploit Intelligence/Vulnerability Analysis Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhaiis/Vllm Spyre Rhel/Rhaiis/Vllm Tpu Rhel/Cloudservices/Vulnerability Engine App/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 24/Controller Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Cloudservices/Insights Engine/Rhoai/Odh Ml Pipelines Runtime Generic Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Ta Lmes Job Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Automation Controller/Cloudservices/Floorist/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Model Registry Job Async Upload Rhel/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Rhoai/Odh Openvino Model Server Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Ask Sre/Rhelai3/Bootc Gaudi Rhel/Ansible Automation Platform Tech Preview/Ee Minimal Rhel/Rhoai/Odh Training Cuda121 Torch24 Py311 Rhel/Rhoai/Odh Training Cuda124 Torch25 Py311 Rhel/Rhoai/Odh Training Cuda128 Torch28 Py312 Rhel/Rhoai/Odh Training Rocm62 Torch24 Py311 Rhel/Rhoai/Odh Training Rocm62 Torch25 Py311 Rhel/Rhoai/Odh Training Rocm64 Torch28 Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Astro Virtual Assistant V/Lightspeed Core/Lightspeed Stack Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Mta/Mta Solution Server Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Mlserver Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Pipeline Runtime Minimal Cpu Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Minimal Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Minimal Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Minimal Rocm Py312 Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform 25/Controller Rhel/Ansible Automation Platform 25/Lightspeed Rhel/Ansible Automation Platform 26/Ansible Dev Tools Rhel/Ansible Automation Platform 26/Controller Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 26/De Supported Rhel/Ansible Automation Platform 26/Ee Minimal Rhel/Ansible Automation Platform 26/Ee Supported Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 26/Lightspeed Rhel/Ansible Automation Platform 26/Platform Resource Runner Rhel/Ansible Automation Platform 27/Controller Rhel/Ansible Automation Platform 27/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 27/Ee Control Plane Rhel/Ansible Automation Platform 27/Ee Minimal Rhel/Ansible Automation Platform 27/Ee Supported Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Lightspeed Rhel/Ansible Automation Platform 27/Platform Resource Runner Rhel/Ansible Automation Platform/Ee Minimal Rhel/Galaxy Ng/Automation Hub Container/Redhat User Workloads/Ansible Saas Ee/Ansible On Clouds/Gh Action Runner/Ansible Ai Connect Service/Insights Engine/Cloudservices/Subscription Central Automation/Google Lightspeed Agent/Lscore Deploy/Vulnerability Engine/Cloudservices/Sha Extractor/Lightspeed Core/Rag Tool Cpu Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Nlp Rhel/Rhoai/Odh Mlserver Cuda Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Discovery/Discovery Server Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gcp Cuda Rhel/Rhelai3/Bootc Rocm Rhel/Satellite/Iop Insights Engine Rhel/Satellite/Iop Vulnerability Engine Rhel/Python3.12 Aiohttp/Python Aiohttp/Insights Host Inventory/Aap Rag Content/Ansible Chatbot Stack/Aoc/Ee Aap Azure Sre/Ansible On Clouds/Aoc Utility/Redhat User Workloads/Release Service Utils Standalone/Lightspeed Services Ocp/Ocp Rules Rhel/App Sre/Managed Prometheus Exporter Initcontainer/App Sre/Managed Prometheus Exporter Base/Python3X Aiohttp builds), which replace tempfile.TemporaryFile with SpooledTemporaryFile to buffer file parts in memory up to 1 MB and enforce client_max_size on total received payload bytes, closing multipart HTTP POST requests containing numerous small file parts. Until patched, this is a concern on Network-accessible aiohttp HTTP servers where request handlers invoke Request.post() without authentication, so Restrict network access to unauthenticated HTTP endpoints that invoke Request.post(), or place an upstream proxy to drop multipart POST requests with excessive part counts. As a compensating measure, Configure systemd WatchdogSec and process Restart directives to detect hung processes and automatically restart instances during file descriptor starvation and Apply rate limiting and connection throttling on incoming HTTP POST requests by client IP to impede rapid exhaustion attempts. These controls limit blast radius and contain exploitation, but they do not fix the underlying file descriptor exhaustion defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:1e8efda03deae9942668d48575d66401d6f39b6fec4b60ef2fc1bbb97fb0b8bf_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:c557cf1e4370b5f50f77d3876267ff935beab87542024f4fc0e85a7126dc7c43_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:69a0fa75c8f7c25a26e5194a3dfc5cb1450522348c5ed7cfefa0a6ef18b311cc_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:ea04bdb568c7bc3a551d5b6ab732d12cd2f14c8ce27a0d3ef2416658e8a06b47_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.