RHSA-2026:92859

Vulnerability from csaf_redhat - Published: 2026-10-29 21:37 - Updated: 2026-10-30 09:20
Summary
Red Hat Security Advisory: Satellite 6.17 security update
Severity
Important
Notes
Topic: A security update for Red Hat Satellite 6.17 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.
Details: * openvox-agent: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924). * openvox-agent: heap buffer overflow in CMS key unwrapping (CVE-2026-63072). * openvox-agent: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076). * openvox-server: Bouncy Castle for Java: Denial of Service via unchecked DTLS handshake reassembler buffer allocation (CVE-2026-59646). * openvox-server: Eclipse Jetty: Access control bypass via case-sensitive host filtering (CVE-2026-18660). * openvox-server: jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494). * openvox-server: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407). * openvox-server: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425). * openvox-server: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497). * openvox-server: Jetty: HTTP request smuggling via crafted chunked requests (CVE-2026-19203). * puppet-agent: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924). * puppet-agent: heap buffer overflow in CMS key unwrapping (CVE-2026-63072). * puppet-agent: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076). * puppetserver: Eclipse Jetty: Access control bypass via case-sensitive host filtering (CVE-2026-18660). * puppetserver: jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494). * puppetserver: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407). * puppetserver: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497). * puppetserver: Jetty: HTTP request smuggling via crafted chunked requests (CVE-2026-19203). * satellite/iop-vmaas-rhel9: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852). * yggdrasil-worker-forwarder: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031). * yggdrasil-worker-forwarder: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943). * yggdrasil-worker-forwarder: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667). * yggdrasil-worker-forwarder: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440). * yggdrasil-worker-forwarder: gRPC-Go: Denial of Service via malformed RPC requests (CVE-2026-84445). * yggdrasil-worker-forwarder: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669).
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-8924

A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to compromising request integrity.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE-565 - Reliance on Cookies without Validation and Integrity Checking
Affected products
Product Identifier Version Remediation
Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch —
Workaround
Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src —
Workaround
Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch —
Workaround
Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src —
Workaround
Unresolved product id: 9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src —
Workaround
Unresolved product id: 9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64 —
Workaround
Threats
Impact Moderate
CVE-2026-18660

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to bypass access controls and reach restricted resources. The issue occurs because the server and proxy components perform case-sensitive validation on host allowlists and denylists. By sending requests with altered character casing in the host name, an attacker can circumvent configured host filtering policies.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CWE-178 - Improper Handling of Case Sensitivity
Affected products
Product Identifier Version Remediation
Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src —
Workaround
Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64 —
Workaround
Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src —
Workaround
Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64 —
Workaround
Unresolved product id: 9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src —
Workaround
Unresolved product id: 9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64 —
Workaround
Threats
Impact Important
CVE-2026-19203

A flaw was found in Jetty. A remote attacker can exploit this vulnerability by sending specially crafted HTTP/1.1 chunked requests. This can cause Jetty and an intermediary proxy to interpret different request boundaries, potentially leading to HTTP request smuggling. This issue arises from Jetty's acceptance of a lone Line Feed (LF) character as a terminator during chunked request parsing.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 4 products, the same list as for CVE-2026-18660
Known not affected 6 products, the same list as for CVE-2026-18660
Threats
Impact Important
CVE-2026-56852

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products
Product Identifier Version Remediation
Unresolved product id: 9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src —
Workaround
Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64 —
Workaround
Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch —
Workaround
Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src —
Workaround
Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src —
Workaround
Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64 —
Workaround
Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch —
Workaround
Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src —
Workaround
Threats
Impact Important
CVE-2026-59646

A flaw was found in Bouncy Castle for Java. The DTLS (Datagram Transport Layer Security) handshake reassembler allocates buffers based on an unchecked 24-bit length value. A remote attacker could exploit this vulnerability by sending a specially crafted DTLS handshake message, leading to excessive memory allocation and a denial of service (DoS) condition.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-131 - Incorrect Calculation of Buffer Size
Affected products
Fixed 4 products, the same list as for CVE-2026-18660
Known not affected 6 products, the same list as for CVE-2026-18660
Threats
Impact Important
CVE-2026-63072

A flaw was found in OpenSSL. A crafted CMS (Cryptographic Message Syntax) message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMS_decrypt(). This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap primitive. This can lead to memory corruption, resulting in a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 4 products, the same list as for CVE-2026-8924
Known not affected 6 products, the same list as for CVE-2026-8924
Threats
Impact Moderate
CVE-2026-63076

A flaw was found in OpenSSL. A crafted CMP (Certificate Management Protocol) message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client, resulting in a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 4 products, the same list as for CVE-2026-8924
Known not affected 6 products, the same list as for CVE-2026-8924
Threats
Impact Moderate
CVE-2026-68494

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 4 products, the same list as for CVE-2026-18660
Known not affected 6 products, the same list as for CVE-2026-18660
Threats
Impact Important
CVE-2026-68497

A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service (DoS) by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` fields from JSON strings, where the system processes arbitrarily long numeric components. This can lead to high CPU utilization, potentially saturating server worker threads and making the service unavailable.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-400 - Uncontrolled Resource Consumption
Affected products
Fixed 4 products, the same list as for CVE-2026-18660
Known not affected 6 products, the same list as for CVE-2026-18660
Threats
Impact Important
CVE-2026-78667

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service (DoS) by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU resources, rendering the application unresponsive to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 2 products, the same list as for CVE-2026-56852
Known not affected 8 products, the same list as for CVE-2026-56852
Threats
Impact Important
CVE-2026-78669

A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service (DoS) by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration (SETTINGS) frames that modify window sizes, an attacker forces the system into intensive state processing. This resource exhaustion degrades performance and can render the service unresponsive.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 2 products, the same list as for CVE-2026-56852
Known not affected 8 products, the same list as for CVE-2026-56852
Threats
Impact Important
CVE-2026-84445

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer() can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a Denial of Service (DoS). In some deployments, this attack can be unauthenticated.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 2 products, the same list as for CVE-2026-56852
Known not affected 8 products, the same list as for CVE-2026-56852
Threats
Impact Important
CVE-2026-89407

A flaw was found in jackson-core. An attacker can supply specially crafted JSON that, when deserialized into a numeric target type, triggers a Regular expression Denial of Service (ReDoS) vulnerability. This occurs due to quadratic backtracking in the NumberInput.looksLikeValidNumber() method's PATTERN_FLOAT regular expression. A small number of concurrent requests with a long input string can exhaust a server's request-handling thread pool, leading to a Denial of Service (DoS).

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1333 - Inefficient Regular Expression Complexity
Affected products
Fixed 4 products, the same list as for CVE-2026-18660
Known not affected 6 products, the same list as for CVE-2026-18660
Threats
Impact Moderate
CVE-2026-89425

A flaw was found in FasterXML jackson-core. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted, malformed token to the JsonFactory.createParser(DataInput) method. The UTF8DataInputJsonParser component, responsible for handling DataInput sources, does not properly limit the size of the error message generated for invalid tokens. This unbounded growth of the StringBuilder can consume excessive memory, leading to an OutOfMemoryError and crashing the Java Virtual Machine (JVM).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Fixed 4 products, the same list as for CVE-2026-18660
Known not affected 6 products, the same list as for CVE-2026-18660
Threats
Impact Important
CVE-2026-94440

A flaw was found in the mime/multipart and net/textproto packages in Go. A remote attacker could exploit this vulnerability by submitting a crafted multipart form request that bypasses configured memory limits when the remaining boundary limit is small. This issue allows the application to read an arbitrarily long line into memory, leading to excessive resource consumption and a Denial of Service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 2 products, the same list as for CVE-2026-56852
Known not affected 8 products, the same list as for CVE-2026-56852
Threats
Impact Moderate
CVE-2026-97031

A flaw was found in crypto/tls. A remote attacker can trigger this vulnerability by sending a specially crafted packet containing multiple Encrypted Client Hello (ECH) outer extension references to a server. Processing these unauthorized references leads to excessive memory consumption, causing a Denial of Service (DoS) through server crashes or unresponsiveness.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 2 products, the same list as for CVE-2026-56852
Known not affected 8 products, the same list as for CVE-2026-56852
Threats
Impact Important
CVE-2026-111943

A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.

6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 2 products, the same list as for CVE-2026-56852
Known not affected 8 products, the same list as for CVE-2026-56852
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:92859 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2496765 external
https://bugzilla.redhat.com/show_bug.cgi?id=2504233 external
https://bugzilla.redhat.com/show_bug.cgi?id=2510193 external
https://bugzilla.redhat.com/show_bug.cgi?id=2511026 external
https://bugzilla.redhat.com/show_bug.cgi?id=2517560 external
https://bugzilla.redhat.com/show_bug.cgi?id=2517561 external
https://bugzilla.redhat.com/show_bug.cgi?id=2529768 external
https://bugzilla.redhat.com/show_bug.cgi?id=2531964 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533175 external
https://bugzilla.redhat.com/show_bug.cgi?id=2538720 external
https://bugzilla.redhat.com/show_bug.cgi?id=2539084 external
https://bugzilla.redhat.com/show_bug.cgi?id=2548334 external
https://bugzilla.redhat.com/show_bug.cgi?id=2548336 external
https://bugzilla.redhat.com/show_bug.cgi?id=2548341 external
https://bugzilla.redhat.com/show_bug.cgi?id=2548344 external
https://bugzilla.redhat.com/show_bug.cgi?id=2553134 external
https://bugzilla.redhat.com/show_bug.cgi?id=2556068 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-8924 self
https://bugzilla.redhat.com/show_bug.cgi?id=2496765 external
https://www.cve.org/CVERecord?id=CVE-2026-8924 external
https://nvd.nist.gov/vuln/detail/CVE-2026-8924 external
https://curl.se/docs/CVE-2026-8924.html external
https://curl.se/docs/CVE-2026-8924.json external
https://hackerone.com/reports/3733905 external
https://access.redhat.com/security/cve/CVE-2026-18660 self
https://bugzilla.redhat.com/show_bug.cgi?id=2553134 external
https://www.cve.org/CVERecord?id=CVE-2026-18660 external
https://nvd.nist.gov/vuln/detail/CVE-2026-18660 external
https://github.com/jetty/jetty.project/security/a… external
https://gitlab.eclipse.org/security/cve-assignmen… external
https://access.redhat.com/security/cve/CVE-2026-19203 self
https://bugzilla.redhat.com/show_bug.cgi?id=2529768 external
https://www.cve.org/CVERecord?id=CVE-2026-19203 external
https://nvd.nist.gov/vuln/detail/CVE-2026-19203 external
https://github.com/jetty/jetty.project/security/a… external
https://access.redhat.com/security/cve/CVE-2026-56852 self
https://bugzilla.redhat.com/show_bug.cgi?id=2504233 external
https://www.cve.org/CVERecord?id=CVE-2026-56852 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56852 external
https://go.dev/cl/794100 external
https://go.dev/issue/80142 external
https://pkg.go.dev/vuln/GO-2026-5970 external
https://access.redhat.com/security/cve/CVE-2026-59646 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510193 external
https://www.cve.org/CVERecord?id=CVE-2026-59646 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59646 external
https://github.com/bcgit/bc-java/commit/2d98721e7… external
https://github.com/bcgit/bc-java/commit/2ea38942c… external
https://github.com/bcgit/bc-java/wiki/CVE-2026-59646 external
https://access.redhat.com/security/cve/CVE-2026-63072 self
https://bugzilla.redhat.com/show_bug.cgi?id=2517560 external
https://www.cve.org/CVERecord?id=CVE-2026-63072 external
https://nvd.nist.gov/vuln/detail/CVE-2026-63072 external
https://openssl-library.org/news/secadv/20260825.txt external
https://access.redhat.com/security/cve/CVE-2026-63076 self
https://bugzilla.redhat.com/show_bug.cgi?id=2517561 external
https://www.cve.org/CVERecord?id=CVE-2026-63076 external
https://nvd.nist.gov/vuln/detail/CVE-2026-63076 external
https://access.redhat.com/security/cve/CVE-2026-68494 self
https://bugzilla.redhat.com/show_bug.cgi?id=2511026 external
https://www.cve.org/CVERecord?id=CVE-2026-68494 external
https://nvd.nist.gov/vuln/detail/CVE-2026-68494 external
https://github.com/FasterXML/jackson-core/commit/… external
https://github.com/FasterXML/jackson-core/commit/… external
https://github.com/FasterXML/jackson-core/commit/… external
https://github.com/FasterXML/jackson-core/pull/1611 external
https://github.com/FasterXML/jackson-core/securit… external
https://github.com/advisories/GHSA-72hv-8253-57qq external
https://www.cve.org/CVERecord?id=CVE-2026-18401 external
https://access.redhat.com/security/cve/CVE-2026-68497 self
https://bugzilla.redhat.com/show_bug.cgi?id=2531964 external
https://www.cve.org/CVERecord?id=CVE-2026-68497 external
https://nvd.nist.gov/vuln/detail/CVE-2026-68497 external
https://github.com/FasterXML/jackson-databind/com… external
https://github.com/FasterXML/jackson-databind/pull/6127 external
https://github.com/FasterXML/jackson-databind/sec… external
https://access.redhat.com/security/cve/CVE-2026-78667 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548334 external
https://www.cve.org/CVERecord?id=CVE-2026-78667 external
https://nvd.nist.gov/vuln/detail/CVE-2026-78667 external
https://go.dev/cl/847309 external
https://go.dev/issue/81858 external
https://groups.google.com/g/golang-announce/c/U2f… external
https://pkg.go.dev/vuln/GO-2026-6609 external
https://access.redhat.com/security/cve/CVE-2026-78669 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548344 external
https://www.cve.org/CVERecord?id=CVE-2026-78669 external
https://nvd.nist.gov/vuln/detail/CVE-2026-78669 external
https://go.dev/cl/847186 external
https://go.dev/cl/847308 external
https://go.dev/issue/81742 external
https://groups.google.com/g/golang-announce/c/ZPw… external
https://pkg.go.dev/vuln/GO-2026-6611 external
https://access.redhat.com/security/cve/CVE-2026-84445 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533175 external
https://www.cve.org/CVERecord?id=CVE-2026-84445 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84445 external
https://github.com/grpc/grpc-go/commit/3822494d8e… external
https://github.com/grpc/grpc-go/commit/8668b69c16… external
https://github.com/grpc/grpc-go/commit/93e31b4854… external
https://github.com/grpc/grpc-go/issues/9354 external
https://github.com/grpc/grpc-go/pull/9365 external
https://github.com/grpc/grpc-go/pull/9366 external
https://github.com/grpc/grpc-go/pull/9367 external
https://github.com/grpc/grpc-go/releases/tag/v1.82.2 external
https://github.com/grpc/grpc-go/releases/tag/v1.83.2 external
https://github.com/grpc/grpc-go/security/advisori… external
https://access.redhat.com/security/cve/CVE-2026-89407 self
https://bugzilla.redhat.com/show_bug.cgi?id=2538720 external
https://www.cve.org/CVERecord?id=CVE-2026-89407 external
https://nvd.nist.gov/vuln/detail/CVE-2026-89407 external
https://github.com/FasterXML/jackson-core/issues/1649 external
https://github.com/FasterXML/jackson-core/pull/1650 external
https://github.com/FasterXML/jackson-core/pull/1701 external
https://github.com/FasterXML/jackson-core/securit… external
https://access.redhat.com/security/cve/CVE-2026-89425 self
https://bugzilla.redhat.com/show_bug.cgi?id=2539084 external
https://www.cve.org/CVERecord?id=CVE-2026-89425 external
https://nvd.nist.gov/vuln/detail/CVE-2026-89425 external
https://github.com/FasterXML/jackson-core/pull/1698 external
https://github.com/FasterXML/jackson-core/securit… external
https://access.redhat.com/security/cve/CVE-2026-94440 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548341 external
https://www.cve.org/CVERecord?id=CVE-2026-94440 external
https://nvd.nist.gov/vuln/detail/CVE-2026-94440 external
https://go.dev/cl/847307 external
https://go.dev/issue/81741 external
https://pkg.go.dev/vuln/GO-2026-6608 external
https://access.redhat.com/security/cve/CVE-2026-97031 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548336 external
https://www.cve.org/CVERecord?id=CVE-2026-97031 external
https://nvd.nist.gov/vuln/detail/CVE-2026-97031 external
https://go.dev/cl/847312 external
https://go.dev/issue/81855 external
https://pkg.go.dev/vuln/GO-2026-6607 external
https://access.redhat.com/security/cve/CVE-2026-111943 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556068 external
https://access.redhat.com/security/vulnerabilitie… external
https://www.cve.org/CVERecord?id=CVE-2026-111943 external
https://nvd.nist.gov/vuln/detail/CVE-2026-111943 external
https://github.com/golang/go/issues/82345 external
https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU external
https://pkg.go.dev/vuln/GO-2026-6809 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A security update for Red Hat Satellite 6.17 is now available.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "* openvox-agent: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924).\n* openvox-agent: heap buffer overflow in CMS key unwrapping (CVE-2026-63072).\n* openvox-agent: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076).\n* openvox-server: Bouncy Castle for Java: Denial of Service via unchecked DTLS handshake reassembler buffer allocation (CVE-2026-59646).\n* openvox-server: Eclipse Jetty: Access control bypass via case-sensitive host filtering (CVE-2026-18660).\n* openvox-server: jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494).\n* openvox-server: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407).\n* openvox-server: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425).\n* openvox-server: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497).\n* openvox-server: Jetty: HTTP request smuggling via crafted chunked requests (CVE-2026-19203).\n* puppet-agent: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924).\n* puppet-agent: heap buffer overflow in CMS key unwrapping (CVE-2026-63072).\n* puppet-agent: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076).\n* puppetserver: Eclipse Jetty: Access control bypass via case-sensitive host filtering (CVE-2026-18660).\n* puppetserver: jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494).\n* puppetserver: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407).\n* puppetserver: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497).\n* puppetserver: Jetty: HTTP request smuggling via crafted chunked requests (CVE-2026-19203).\n* satellite/iop-vmaas-rhel9: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852).\n* yggdrasil-worker-forwarder: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031).\n* yggdrasil-worker-forwarder: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943).\n* yggdrasil-worker-forwarder: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667).\n* yggdrasil-worker-forwarder: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440).\n* yggdrasil-worker-forwarder: gRPC-Go: Denial of Service via malformed RPC requests (CVE-2026-84445).\n* yggdrasil-worker-forwarder: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669).",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:92859",
        "url": "https://access.redhat.com/errata/RHSA-2026:92859"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2496765",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496765"
      },
      {
        "category": "external",
        "summary": "2504233",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
      },
      {
        "category": "external",
        "summary": "2510193",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510193"
      },
      {
        "category": "external",
        "summary": "2511026",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
      },
      {
        "category": "external",
        "summary": "2517560",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517560"
      },
      {
        "category": "external",
        "summary": "2517561",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517561"
      },
      {
        "category": "external",
        "summary": "2529768",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529768"
      },
      {
        "category": "external",
        "summary": "2531964",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531964"
      },
      {
        "category": "external",
        "summary": "2533175",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533175"
      },
      {
        "category": "external",
        "summary": "2538720",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538720"
      },
      {
        "category": "external",
        "summary": "2539084",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539084"
      },
      {
        "category": "external",
        "summary": "2548334",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548334"
      },
      {
        "category": "external",
        "summary": "2548336",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548336"
      },
      {
        "category": "external",
        "summary": "2548341",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548341"
      },
      {
        "category": "external",
        "summary": "2548344",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548344"
      },
      {
        "category": "external",
        "summary": "2553134",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553134"
      },
      {
        "category": "external",
        "summary": "2556068",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556068"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92859.json"
      }
    ],
    "title": "Red Hat Security Advisory: Satellite 6.17 security update",
    "tracking": {
      "current_release_date": "2026-10-30T09:20:10+00:00",
      "generator": {
        "date": "2026-10-30T09:20:10+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.3"
        }
      },
      "id": "RHSA-2026:92859",
      "initial_release_date": "2026-10-29T21:37:57+00:00",
      "revision_history": [
        {
          "date": "2026-10-29T21:37:57+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-29T21:37:57+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-30T09:20:10+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.17 for RHEL 9",
                "product": {
                  "name": "Red Hat Satellite 6.17 for RHEL 9",
                  "product_id": "9Base-satellite-6.17",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6.17::el9"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.17 for RHEL 9",
                "product": {
                  "name": "Red Hat Satellite 6.17 for RHEL 9",
                  "product_id": "9Base-satellite-6.17-capsule",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite_capsule:6.17::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite 6"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openvox-server-0:8.17.0-1.el9sat.src",
                "product": {
                  "name": "openvox-server-0:8.17.0-1.el9sat.src",
                  "product_id": "openvox-server-0:8.17.0-1.el9sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openvox-server@8.17.0-1.el9sat?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openvox-agent-0:8.31.1-1.el9sat.src",
                "product": {
                  "name": "openvox-agent-0:8.31.1-1.el9sat.src",
                  "product_id": "openvox-agent-0:8.31.1-1.el9sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openvox-agent@8.31.1-1.el9sat?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
                "product": {
                  "name": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
                  "product_id": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-forwarder@0.1.1-1.el9sat?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openvox-server-0:8.17.0-1.el9sat.noarch",
                "product": {
                  "name": "openvox-server-0:8.17.0-1.el9sat.noarch",
                  "product_id": "openvox-server-0:8.17.0-1.el9sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openvox-server@8.17.0-1.el9sat?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openvox-agent-0:8.31.1-1.el9sat.x86_64",
                "product": {
                  "name": "openvox-agent-0:8.31.1-1.el9sat.x86_64",
                  "product_id": "openvox-agent-0:8.31.1-1.el9sat.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openvox-agent@8.31.1-1.el9sat?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64",
                "product": {
                  "name": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64",
                  "product_id": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-forwarder@0.1.1-1.el9sat?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openvox-agent-0:8.31.1-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src"
        },
        "product_reference": "openvox-agent-0:8.31.1-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.17-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openvox-agent-0:8.31.1-1.el9sat.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64"
        },
        "product_reference": "openvox-agent-0:8.31.1-1.el9sat.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.17-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openvox-server-0:8.17.0-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch"
        },
        "product_reference": "openvox-server-0:8.17.0-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.17-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openvox-server-0:8.17.0-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src"
        },
        "product_reference": "openvox-server-0:8.17.0-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.17-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openvox-agent-0:8.31.1-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src"
        },
        "product_reference": "openvox-agent-0:8.31.1-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openvox-agent-0:8.31.1-1.el9sat.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64"
        },
        "product_reference": "openvox-agent-0:8.31.1-1.el9sat.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openvox-server-0:8.17.0-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch"
        },
        "product_reference": "openvox-server-0:8.17.0-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openvox-server-0:8.17.0-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
        },
        "product_reference": "openvox-server-0:8.17.0-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src"
        },
        "product_reference": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        },
        "product_reference": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.17"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-8924",
      "cwe": {
        "id": "CWE-565",
        "name": "Reliance on Cookies without Validation and Integrity Checking"
      },
      "discovery_date": "2026-07-03T07:01:32.981435+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2496765"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in curl\u0027s cookie parsing logic. A malicious HTTP server can exploit this by setting \u0027super cookies\u0027 that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to compromising request integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: curl: Cookie injection via malicious HTTP server using super cookies",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: Red Hat rates this flaw Moderate (CVSS 6.5) compared to CISA\u0027s Critical (9.1). The scoring difference is due to two factors: first, exploitation requires the victim\u0027s curl to connect using a trailing-dot hostname (e.g., https://example.co.uk.), a format that is uncommon in practice and incompatible with TLS SNI; second, the direct impact is cookie injection into outbound requests \u2014 not exfiltration of victim data to the attacker. The curl project itself rates this flaw Low severity. Red Hat products that use curl for HTTP communication are affected, but the trailing-dot precondition significantly limits real-world exploitability. This flaw has not been shown to enable impacts beyond session integrity modification.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8924"
        },
        {
          "category": "external",
          "summary": "RHBZ#2496765",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496765"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8924",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8924"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8924",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8924"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-8924.html",
          "url": "https://curl.se/docs/CVE-2026-8924.html"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-8924.json",
          "url": "https://curl.se/docs/CVE-2026-8924.json"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3733905",
          "url": "https://hackerone.com/reports/3733905"
        }
      ],
      "release_date": "2026-07-03T06:15:04.646000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        },
        {
          "category": "workaround",
          "details": "Do not use trailing-dot hostnames in URLs passed to curl. Trailing dots are uncommon and incompatible with TLS SNI. Upgrade to curl 8.21.0 to resolve",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "curl: curl: Cookie injection via malicious HTTP server using super cookies"
    },
    {
      "cve": "CVE-2026-18660",
      "cwe": {
        "id": "CWE-178",
        "name": "Improper Handling of Case Sensitivity"
      },
      "discovery_date": "2026-10-15T09:40:58.551187+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553134"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to bypass access controls and reach restricted resources. The issue occurs because the server and proxy components perform case-sensitive validation on host allowlists and denylists. By sending requests with altered character casing in the host name, an attacker can circumvent configured host filtering policies.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.eclipse.jetty/jetty-server: org.eclipse.jetty/jetty-proxy: Eclipse Jetty: Access control bypass via case-sensitive host filtering",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw allows an attacker to bypass host-based access control in Eclipse Jetty\u0027s server and proxy components. By varying the letter case of the Host header, requests can slip past configured host allow/deny lists, letting an attacker reach resources that virtual-host or proxy filtering was meant to block in affected Red Hat products that use jetty-server or jetty-proxy for this purpose.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18660"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553134",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553134"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18660",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18660"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18660",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18660"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-7wfj-j486-mxrf",
          "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-7wfj-j486-mxrf"
        },
        {
          "category": "external",
          "summary": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/212",
          "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/212"
        }
      ],
      "release_date": "2026-10-15T09:38:02.125000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        },
        {
          "category": "workaround",
          "details": "There is no mitigation for this issue other than applying the fix. As a temporary workaround, administrators who rely on Jetty host allow/deny filtering should add case-variant duplicates of every configured hostname to the filter lists, or enforce hostname case-normalization at an upstream load balancer or reverse proxy, until the update is installed.",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.eclipse.jetty/jetty-server: org.eclipse.jetty/jetty-proxy: Eclipse Jetty: Access control bypass via case-sensitive host filtering"
    },
    {
      "cve": "CVE-2026-19203",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-09-08T12:33:32.310662+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2529768"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Jetty. A remote attacker can exploit this vulnerability by sending specially crafted HTTP/1.1 chunked requests. This can cause Jetty and an intermediary proxy to interpret different request boundaries, potentially leading to HTTP request smuggling. This issue arises from Jetty\u0027s acceptance of a lone Line Feed (LF) character as a terminator during chunked request parsing.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Jetty in affected Red Hat products may permit remote, unauthenticated HTTP request smuggling when specially crafted HTTP/1.1 chunked requests traverse an intermediary that interprets request boundaries differently. Jetty 12.1 uses RFC 9110 compliance by default and is not affected unless configured to use legacy RFC 7230 or RFC 2616 compliance modes. Remediation is being pursued for vulnerable shipped versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19203"
        },
        {
          "category": "external",
          "summary": "RHBZ#2529768",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529768"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19203",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19203"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19203",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19203"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h",
          "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h"
        }
      ],
      "release_date": "2026-09-08T12:08:37.576000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests"
    },
    {
      "cve": "CVE-2026-56852",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-21T20:01:56.266823+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504233"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504233",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/794100",
          "url": "https://go.dev/cl/794100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80142",
          "url": "https://go.dev/issue/80142"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5970",
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "release_date": "2026-07-21T19:18:59.951000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "cve": "CVE-2026-59646",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-08-03T02:01:09.336839+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510193"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Bouncy Castle for Java. The DTLS (Datagram Transport Layer Security) handshake reassembler allocates buffers based on an unchecked 24-bit length value. A remote attacker could exploit this vulnerability by sending a specially crafted DTLS handshake message, leading to excessive memory allocation and a denial of service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.bouncycastle/bc-java: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service via unchecked DTLS handshake reassembler buffer allocation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw has an Important impact. Bouncy Castle for Java\u0027s DTLS handshake reassembler allocates a buffer from an unchecked 24-bit length field, so a remote, unauthenticated attacker who sends a specially crafted DTLS handshake message can force excessive memory allocation and cause a denial of service. Only the Bouncy Castle TLS module (bctls) contains the affected code; Red Hat products that ship only the core provider (bcprov) or other Bouncy Castle modules are not affected. Within Red Hat\u0027s portfolio, the vulnerable module is bundled by Red Hat Fuse (via Apache CXF) and Red Hat Satellite.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59646"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510193",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510193"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59646",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59646"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59646",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59646"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/commit/2d98721e71bbd822ffa0f84e088eea645cf679fa",
          "url": "https://github.com/bcgit/bc-java/commit/2d98721e71bbd822ffa0f84e088eea645cf679fa"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/commit/2ea38942c7917f6d7ab4de93d8a5336d021df0d9",
          "url": "https://github.com/bcgit/bc-java/commit/2ea38942c7917f6d7ab4de93d8a5336d021df0d9"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-59646",
          "url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-59646"
        }
      ],
      "release_date": "2026-08-03T00:48:29.386000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.bouncycastle/bc-java: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service via unchecked DTLS handshake reassembler buffer allocation"
    },
    {
      "cve": "CVE-2026-63072",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-08-17T19:24:54.673000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517560"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. A crafted CMS (Cryptographic Message Syntax) message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMS_decrypt(). This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap primitive. This can lead to memory corruption, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: heap buffer overflow in CMS key unwrapping",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker needs to supply a crafted CMS message to be decrypted in an application by CMS_decrypt(). The out-of-bounds write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the memory allocation, causing memory corruption, but the impact is limited to a denial of service. For these reasons, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-63072"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517560",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517560"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-63072",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-63072"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63072",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63072"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260825.txt",
          "url": "https://openssl-library.org/news/secadv/20260825.txt"
        }
      ],
      "release_date": "2026-08-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: heap buffer overflow in CMS key unwrapping"
    },
    {
      "cve": "CVE-2026-63076",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-08-17T19:30:30.087000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517561"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. A crafted CMP (Certificate Management Protocol) message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs to supply a crafted CMP message to an application acting as a CMP server or client. Server applications need to be configured to accept PBM-protected messages, and client applications need to communicate with a malicious or intercepted CMP server. The missing type check causes an invalid pointer dereference, resulting in a denial of service. There is no memory disclosure, no controlled memory write and no path to code execution. For these reasons, this vulnerability has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-63076"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517561",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517561"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-63076",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-63076"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63076",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63076"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260825.txt",
          "url": "https://openssl-library.org/news/secadv/20260825.txt"
        }
      ],
      "release_date": "2026-08-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg"
    },
    {
      "cve": "CVE-2026-68494",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-04T15:01:53.631865+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511026"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68494"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511026",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
          "url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
          "url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
          "url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/pull/1611",
          "url": "https://github.com/FasterXML/jackson-core/pull/1611"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
          "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
          "url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
        }
      ],
      "release_date": "2026-08-04T14:39:14.471000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        },
        {
          "category": "workaround",
          "details": "Upgrade com.fasterxml.jackson.core:jackson-core to a fixed version, such as 2.18.8 or later, 2.21.4 or later, or the first fixed release in the applicable 2.22.x stream. For Jackson 3.x, upgrade to 3.1.4 or later, or the first fixed release in the applicable 3.2.x stream. If upgrading is not immediately possible, do not expose the non-blocking parser to untrusted, incrementally streamed JSON. Where feasible, use a synchronous parser or buffer and enforce strict request-size, connection-timeout, and concurrency limits at the ingress layer. Apply the upgrade as soon as possible because ingress limits reduce exposure but do not correct the parser defect.",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
    },
    {
      "cve": "CVE-2026-68497",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2026-09-11T16:01:15.919616+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531964"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service (DoS) by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` fields from JSON strings, where the system processes arbitrarily long numeric components. This can lead to high CPU utilization, potentially saturating server worker threads and making the service unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw in jackson-databind allows remote attackers to consume excessive CPU by submitting specially crafted JSON with unbounded numeric values, causing a denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68497"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531964",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531964"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68497",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68497"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd",
          "url": "https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/pull/6127",
          "url": "https://github.com/FasterXML/jackson-databind/pull/6127"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"
        }
      ],
      "release_date": "2026-09-11T15:49:30.366000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        },
        {
          "category": "workaround",
          "details": "Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing"
    },
    {
      "cve": "CVE-2026-78667",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:00:51.418048+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548334"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service (DoS) by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU resources, rendering the application unresponsive to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated with an Important severity for Red Hat products because an unauthenticated remote attacker can exhaust server compute resources over the network, leading to a complete service outage. Across Red Hat enterprise environments, Go is widely deployed in container runtimes, monitoring daemons, and OpenShift infrastructure components. However, exploitation is restricted to applications that actively listen on the network and serve content using standard library HTTP handlers that process multi-range requests. CLI utilities and server components that do not handle byte-range requests from untrusted clients remain unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78667"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548334",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548334"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78667",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78667"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78667",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78667"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847309",
          "url": "https://go.dev/cl/847309"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81858",
          "url": "https://go.dev/issue/81858"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6609",
          "url": "https://pkg.go.dev/vuln/GO-2026-6609"
        }
      ],
      "release_date": "2026-10-08T22:53:59.148000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers"
    },
    {
      "cve": "CVE-2026-78669",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:01:28.964317+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548344"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service (DoS) by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration (SETTINGS) frames that modify window sizes, an attacker forces the system into intensive state processing. This resource exhaustion degrades performance and can render the service unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the Go net/http package and the golang.org/x/net/http2 module. A malicious HTTP/2 peer can cause excessive CPU consumption by opening a large number of HTTP/2 streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. Each SETTINGS frame forces the server or client to iterate over all open streams to adjust their flow-control windows, resulting in quadratic CPU usage and denial of service.\n\nThis vulnerability affects all Go programs that serve or consume HTTP/2 traffic using net/http or golang.org/x/net/http2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78669"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548344",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548344"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78669",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78669"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78669",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78669"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847186",
          "url": "https://go.dev/cl/847186"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847308",
          "url": "https://go.dev/cl/847308"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81742",
          "url": "https://go.dev/issue/81742"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs",
          "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6611",
          "url": "https://pkg.go.dev/vuln/GO-2026-6611"
        }
      ],
      "release_date": "2026-10-08T22:53:59.530000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        },
        {
          "category": "workaround",
          "details": "In case you consume HTTP2, upgrade to a patched version of the http module.\n\nVerify:\n```\ngo version\ngo list -m golang.org/x/net\ngovulncheck ./...\n```",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames"
    },
    {
      "cve": "CVE-2026-84445",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-09-14T16:22:17.356407+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533175"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer() can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a Denial of Service (DoS). In some deployments, this attack can be unauthenticated.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533175",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533175"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84445",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84445",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7",
          "url": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4",
          "url": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f",
          "url": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/issues/9354",
          "url": "https://github.com/grpc/grpc-go/issues/9354"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/pull/9365",
          "url": "https://github.com/grpc/grpc-go/pull/9365"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/pull/9366",
          "url": "https://github.com/grpc/grpc-go/pull/9366"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/pull/9367",
          "url": "https://github.com/grpc/grpc-go/pull/9367"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2",
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2",
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj",
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"
        }
      ],
      "release_date": "2026-09-14T16:11:41.401000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests"
    },
    {
      "cve": "CVE-2026-89407",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-09-22T20:07:47.987231+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2538720"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-core. An attacker can supply specially crafted JSON that, when deserialized into a numeric target type, triggers a Regular expression Denial of Service (ReDoS) vulnerability. This occurs due to quadratic backtracking in the NumberInput.looksLikeValidNumber() method\u0027s PATTERN_FLOAT regular expression. A small number of concurrent requests with a long input string can exhaust a server\u0027s request-handling thread pool, leading to a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact because while remote actors can induce CPU starvation to trigger a denial of service, the issue affects availability only without granting unauthorized access or data tampering capabilities. In Red Hat environments, exposure depends on services deserializing untrusted JSON payloads into numeric Java object types where default string coercion occurs. Older releases packaging jackson-core versions prior to 2.17.0 do not include the vulnerable pattern matching logic and are unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-89407"
        },
        {
          "category": "external",
          "summary": "RHBZ#2538720",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538720"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-89407",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-89407"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89407",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89407"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/issues/1649",
          "url": "https://github.com/FasterXML/jackson-core/issues/1649"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/pull/1650",
          "url": "https://github.com/FasterXML/jackson-core/pull/1650"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/pull/1701",
          "url": "https://github.com/FasterXML/jackson-core/pull/1701"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89",
          "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89"
        }
      ],
      "release_date": "2026-09-22T14:53:20.999000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking"
    },
    {
      "cve": "CVE-2026-89425",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-09-23T02:30:57.997196+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539084"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FasterXML jackson-core. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted, malformed token to the JsonFactory.createParser(DataInput) method. The UTF8DataInputJsonParser component, responsible for handling DataInput sources, does not properly limit the size of the error message generated for invalid tokens. This unbounded growth of the StringBuilder can consume excessive memory, leading to an OutOfMemoryError and crashing the Java Virtual Machine (JVM).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A denial of service flaw exists in FasterXML jackson-core where processing malformed JSON tokens from a DataInput source can lead to unbounded memory allocation. This vulnerability can exhaust system resources, causing a Java Virtual Machine (JVM) crash and impacting the availability of services that utilize the affected JsonFactory.createParser(DataInput) method with untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-89425"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539084",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539084"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-89425",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-89425"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/pull/1698",
          "url": "https://github.com/FasterXML/jackson-core/pull/1698"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf",
          "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"
        }
      ],
      "release_date": "2026-09-23T02:06:10.571000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing"
    },
    {
      "cve": "CVE-2026-94440",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:01:17.316758+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548341"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mime/multipart and net/textproto packages in Go. A remote attacker could exploit this vulnerability by submitting a crafted multipart form request that bypasses configured memory limits when the remaining boundary limit is small. This issue allows the application to read an arbitrarily long line into memory, leading to excessive resource consumption and a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having a Moderate severity for Red Hat products because, while an unauthenticated remote attacker can trigger excessive memory consumption leading to a denial of service, exploitation cannot lead to code execution or information disclosure. The issue specifically threatens Go-based services and daemons that accept and process incoming multipart HTTP form payloads. Applications built with Go that do not expose web interfaces or parse multipart request streams are unaffected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94440"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548341",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548341"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94440",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94440"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94440",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94440"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847307",
          "url": "https://go.dev/cl/847307"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81741",
          "url": "https://go.dev/issue/81741"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6608",
          "url": "https://pkg.go.dev/vuln/GO-2026-6608"
        }
      ],
      "release_date": "2026-10-08T22:53:58.959000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing"
    },
    {
      "cve": "CVE-2026-97031",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:00:59.284728+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548336"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in crypto/tls. A remote attacker can trigger this vulnerability by sending a specially crafted packet containing multiple Encrypted Client Hello (ECH) outer extension references to a server. Processing these unauthorized references leads to excessive memory consumption, causing a Denial of Service (DoS) through server crashes or unresponsiveness.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can trigger memory exhaustion and crash server processes without requiring privileges or user interaction. Go applications that terminate TLS connections and accept Encrypted Client Hello configurations are vulnerable to resource amplification during the initial handshake. While the flaw does not facilitate arbitrary code execution or compromise data confidentiality, the resulting denial of service can disrupt critical network services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97031"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548336",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548336"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97031",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97031"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97031",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97031"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847312",
          "url": "https://go.dev/cl/847312"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81855",
          "url": "https://go.dev/issue/81855"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6607",
          "url": "https://pkg.go.dev/vuln/GO-2026-6607"
        }
      ],
      "release_date": "2026-10-08T22:53:58.775000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references"
    },
    {
      "cve": "CVE-2026-111943",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-20T09:38:36.160000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556068"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important because Go applications validating TLS certificates could accept unauthorized certificates issued by distrusted intermediate Certificate Authorities, potentially compromising the integrity and confidentiality of secure network communications. Any Go-based client or server relying on standard certificate verification may be exposed to man-in-the-middle attacks if an attacker intercepts traffic using certificates derived from these intermediate keys. Exploitation requires specific network positioning and certificates generated by the untrusted intermediate authorities, limiting opportunistic widespread abuse.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556068",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556068"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-012",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-111943",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111943",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/go/issues/82345",
          "url": "https://github.com/golang/go/issues/82345"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU",
          "url": "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6809",
          "url": "https://pkg.go.dev/vuln/GO-2026-6809"
        }
      ],
      "release_date": "2026-10-20T02:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:57+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92859"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.17:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.17:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.17:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.