{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new satellite/iop-remediations-rhel9 container image is now generally available in the Red Hat container registry.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying  predefined rules to a small set of local data, such as installed packages,  running services, and configuration settings.  When you install Red Hat Lightspeed in Satellite locally,  you can generate Red Hat Lightspeed recommendations without  sending system data to Red Hat services. ",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:92578",
        "url": "https://access.redhat.com/errata/RHSA-2026:92578"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-102276",
        "url": "https://access.redhat.com/security/cve/CVE-2026-102276"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-102278",
        "url": "https://access.redhat.com/security/cve/CVE-2026-102278"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-90711",
        "url": "https://access.redhat.com/security/cve/CVE-2026-90711"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-9496",
        "url": "https://access.redhat.com/security/cve/CVE-2026-9496"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-97057",
        "url": "https://access.redhat.com/security/cve/CVE-2026-97057"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/software/containers/search",
        "url": "https://catalog.redhat.com/software/containers/search"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92578.json"
      }
    ],
    "title": "Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image",
    "tracking": {
      "current_release_date": "2026-11-06T07:57:51+00:00",
      "generator": {
        "date": "2026-11-06T07:57:51+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:92578",
      "initial_release_date": "2026-10-29T16:30:42+00:00",
      "revision_history": [
        {
          "date": "2026-10-29T16:30:42+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-29T16:30:48+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-06T07:57:51+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.19",
                "product": {
                  "name": "Red Hat Satellite 6.19",
                  "product_id": "Red Hat Satellite 6.19",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6.19::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64",
                "product": {
                  "name": "registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64",
                  "product_id": "registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/iop-remediations-rhel9@sha256%3A010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e?arch=amd64\u0026repository_url=registry.redhat.io/satellite/iop-remediations-rhel9\u0026tag=1793092253"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64 as a component of Red Hat Satellite 6.19",
          "product_id": "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
        },
        "product_reference": "registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64",
        "relates_to_product_reference": "Red Hat Satellite 6.19"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-9496",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-05-26T07:00:51.002449+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481394"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the pacote component. A remote attacker can exploit this denial of service (DoS) vulnerability by providing a specially crafted input to the `addGitSha` function. This malicious input triggers excessive CPU consumption due to regex replacement and string manipulation, which can lead to the process stalling or crashing.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the pacote npm package. Pacote retrieves package metadata and archives from npm registries, Git repositories, and other sources. In affected versions, the addGitSha function strips Git committish information from a package specification using a regular expression that is vulnerable to inefficient backtracking. An attacker who can supply a crafted spec.rawSpec value can cause the Node.js process that calls pacote to consume excessive CPU and become unresponsive, resulting in denial of service.\n\nRed Hat products that include pacote versions from 11.2.7 up to (but not including) 21.5.1 may be affected when Node.js workloads process package specifications through pacote or through npm operations that depend on pacote. The impact is limited to the Node.js process performing that work; host operating systems are not directly affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-9496"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481394",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481394"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-9496",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-9496"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9496",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9496"
        },
        {
          "category": "external",
          "summary": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2",
          "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2"
        },
        {
          "category": "external",
          "summary": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025",
          "url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025"
        },
        {
          "category": "external",
          "summary": "https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084",
          "url": "https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084"
        }
      ],
      "release_date": "2026-05-26T05:00:07.813000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T16:30:42+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92578"
        },
        {
          "category": "workaround",
          "details": "To mitigate this limit the length of incoming package specifiers (spec.rawSpec) before they reach the resolution service. Enforce hard CPU time limits or timeouts on isolated build jobs and package resolution processes.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function"
    },
    {
      "cve": "CVE-2026-90711",
      "cwe": {
        "id": "CWE-290",
        "name": "Authentication Bypass by Spoofing"
      },
      "discovery_date": "2026-09-15T06:41:11.029083+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533602"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this vulnerability by submitting a forged X-Forwarded-For header to spoof their client IP address. This flaw allows attackers to bypass IP-based access controls, rate limiting, and audit logging.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because unauthenticated remote attackers can spoof client IP addresses and circumvent security controls, such as rate limits or network access lists, by sending custom forwarding headers. Exploitation is contingent on application configurations that define reverse proxy trust subnets using IPv4-mapped IPv6 notation with short IPv4 prefix lengths. Environments configuring trusted proxies via canonical IPv4 CIDR blocks, hostnames, or default loopback addresses are not vulnerable to this behavior.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-90711"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533602",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533602"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-90711",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-90711"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90711",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90711"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h",
          "url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h"
        }
      ],
      "release_date": "2026-09-15T06:19:46.332000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T16:30:42+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92578"
        },
        {
          "category": "workaround",
          "details": "To mitigate this flaw through configuration:\n\n1. Configure trusted proxy definitions using standard IPv4 notation (such as `10.0.0.0/8`) rather than IPv4-mapped IPv6 notation.\n2. If IPv4-mapped IPv6 notation is required, set the subnet prefix length to at least 97 to cover the mapped boundary (for example, specify `::ffff:10.0.0.0/104` instead of `::ffff:10.0.0.0/8`).\n3. Alternatively, sanitize or strip incoming `X-Forwarded-For` headers at edge load balancers or boundary reverse proxies before passing traffic to backend applications.\n\nWarning: Modifying application configuration files requires restarting the Node.js application service, which will temporarily interrupt service availability and active connections.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet"
    },
    {
      "cve": "CVE-2026-97057",
      "cwe": {
        "id": "CWE-130",
        "name": "Improper Handling of Length Parameter Inconsistency"
      },
      "discovery_date": "2026-09-24T14:03:18.948705+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2540095"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in redis-parser. This vulnerability allows a malicious or compromised Redis endpoint to trigger an uncaught RangeError by sending a crafted RESP (REdis Serialization Protocol) header with an excessively large declared length. The flaw occurs because redis-parser fails to validate the multi-bulk length value during RESP protocol parsing. Successful exploitation can lead to a Denial of Service (DoS) by crashing the Node.js client process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis-parser: redis-parser: Denial of Service via invalid RESP protocol array length",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important-impact denial-of-service flaw was found in redis-parser, a Node.js library that parses the Redis RESP protocol. redis-parser does not validate the multi-bulk (array) length value during RESP protocol parsing, so a malicious or compromised Redis endpoint can send a crafted RESP header declaring an excessively large length (above 2^32-1), which triggers an uncaught RangeError and crashes the Node.js client process that connected to it. Only the availability of the client process is impacted; there is no impact to confidentiality or integrity. Red Hat rates this flaw Important with a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), slightly lower than the 8.7 CVSS 4.0 score in the upstream CVE.org record, although both ratings correspond to Important severity.\n\nThe redis-parser library is bundled as a dependency in Red Hat Ansible Automation Platform (automation-portal containers), Red Hat Satellite, and Red Hat Insights remediations components; these products are tracked as affected and a fix is being pursued by the responsible product teams. Other Red Hat offerings that bundle redis-parser, including Red Hat Developer Hub, Red Hat JBoss Fuse, and the cloudservices remediations container, have been assessed as not affected because the vulnerable code is not in an executed path or the component is not present in those products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97057"
        },
        {
          "category": "external",
          "summary": "RHBZ#2540095",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540095"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97057",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97057"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97057",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97057"
        },
        {
          "category": "external",
          "summary": "https://github.com/NodeRedis/node-redis-parser",
          "url": "https://github.com/NodeRedis/node-redis-parser"
        },
        {
          "category": "external",
          "summary": "https://github.com/NodeRedis/node-redis-parser/blob/4c2d31c8717f05dea1ffd91a0e45d68f452c73bd/lib/parser.js#L108-L122",
          "url": "https://github.com/NodeRedis/node-redis-parser/blob/4c2d31c8717f05dea1ffd91a0e45d68f452c73bd/lib/parser.js#L108-L122"
        },
        {
          "category": "external",
          "summary": "https://github.com/NodeRedis/node-redis-parser/blob/4c2d31c8717f05dea1ffd91a0e45d68f452c73bd/lib/parser.js#L212",
          "url": "https://github.com/NodeRedis/node-redis-parser/blob/4c2d31c8717f05dea1ffd91a0e45d68f452c73bd/lib/parser.js#L212"
        },
        {
          "category": "external",
          "summary": "https://github.com/NodeRedis/node-redis-parser/blob/4c2d31c8717f05dea1ffd91a0e45d68f452c73bd/lib/parser.js#L492-L550",
          "url": "https://github.com/NodeRedis/node-redis-parser/blob/4c2d31c8717f05dea1ffd91a0e45d68f452c73bd/lib/parser.js#L492-L550"
        },
        {
          "category": "external",
          "summary": "https://github.com/NodeRedis/node-redis-parser/issues/47",
          "url": "https://github.com/NodeRedis/node-redis-parser/issues/47"
        },
        {
          "category": "external",
          "summary": "https://github.com/NodeRedis/node-redis-parser/issues/65",
          "url": "https://github.com/NodeRedis/node-redis-parser/issues/65"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/redis-parser-through-3.0.0-denial-of-service-via-invalid-array-length",
          "url": "https://www.vulncheck.com/advisories/redis-parser-through-3.0.0-denial-of-service-via-invalid-array-length"
        }
      ],
      "release_date": "2026-09-24T13:51:58.036000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T16:30:42+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92578"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis-parser: redis-parser: Denial of Service via invalid RESP protocol array length"
    },
    {
      "cve": "CVE-2026-102276",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-28T21:02:20.910434+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2542707"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this vulnerability as Important because an unauthenticated remote attacker can crash running Node.js services by submitting malformed pattern strings, resulting in a denial of service. In Red Hat environments, applications that accept arbitrary glob or expansion patterns from external inputs are susceptible to unexpected termination due to an unhandled call stack overflow. While this flaw allows service interruption without requiring privileges, it does not lead to code execution or compromise data confidentiality and integrity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102276"
        },
        {
          "category": "external",
          "summary": "RHBZ#2542707",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542707"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102276",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102276"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102276",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102276"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
          "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
          "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
          "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
          "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"
        }
      ],
      "release_date": "2026-09-28T20:50:59.984000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T16:30:42+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92578"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns"
    },
    {
      "cve": "CVE-2026-102278",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-28T21:00:55.949756+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2542700"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the application to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because remote unauthenticated attackers can supply crafted nested expressions to trigger native stack exhaustion and crash server-side processes, resulting in a denial of service without compromising system confidentiality or integrity. In Red Hat environments, the affected library is distributed across containerized web consoles, developer tools, and Node.js runtime environments. Exploitation is constrained to deployments where applications process untrusted, user-defined pattern inputs directly through expansion functions without input depth validation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102278"
        },
        {
          "category": "external",
          "summary": "RHBZ#2542700",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542700"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102278",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102278"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102278",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102278"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
          "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
          "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
          "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"
        }
      ],
      "release_date": "2026-09-28T20:57:09.850000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T16:30:42+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92578"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns"
    }
  ]
}