{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A security update for Red Hat Satellite is now available.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This advisory provides security fixes for affected packages used by Red Hat Satellite. The updates address the vulnerabilities described below.\n\nSecurity Fix(es):\n\n* python-django and python3.12-django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307).\n* yggdrasil-worker-forwarder: Denial of Service in Go net/http due to unencrypted HTTP/2 connections (CVE-2026-56853).\n* yggdrasil-worker-forwarder: Denial of Service via malformed RPC requests in gRPC-Go (CVE-2026-84445).\n* yggdrasil-worker-forwarder: Denial of Service via multiple ECH outer extension references in crypto/tls (CVE-2026-97031).\n* yggdrasil-worker-forwarder: Denial of Service via crafted HTTP Range headers in Go (CVE-2026-78667).\n* yggdrasil-worker-forwarder: Denial of Service via excessive HTTP/2 SETTINGS frames in net/http (CVE-2026-78669).\n* yggdrasil-worker-forwarder: Man-in-the-middle attacks via untrusted intermediate certificates in crypto/x509 (CVE-2026-111943).\n* yggdrasil-worker-forwarder: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440).\n* openvox-server: Denial of Service via unchecked DTLS handshake reassembler buffer allocation in Bouncy Castle for Java (CVE-2026-59646).\n* openvox-server: CPU Denial of Service via unbounded numeric parsing in jackson-databind (CVE-2026-68497).\n* openvox-server: HTTP request smuggling via crafted chunked requests in Jetty (CVE-2026-19203).\n* openvox-server: Denial of Service via regular expression backtracking in jackson-core (CVE-2026-89407).\n* openvox-server: Denial of Service via unbounded StringBuilder growth during malformed token processing in jackson-core (CVE-2026-89425).\n* openvox-server: Access control bypass via case-sensitive host filtering in Eclipse Jetty (CVE-2026-18660).\n* python3.12-urllib3: Denial of Service via unbounded memory allocation in the chunk parser (CVE-2026-97689).\n* python3.12-urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687).\n* python3.12-gitpython: Denial of Service via a crafted commit author field (CVE-2026-87819).\n* python3.12-gitpython: Denial of Service via regular expression backtracking in date parsing (CVE-2026-110856).\n* python3.12-gitpython: Arbitrary code execution via improper submodule path validation (CVE-2026-114145).\n* python3.12-gitpython: Command injection via Remote.pull() refspec in GitPython before 3.2.0 (CVE-2026-110858).\n* python3.12-gitpython: Arbitrary file read via argument injection in branch checkout (CVE-2026-110859).\n* python3.12-gitpython: Arbitrary code execution via unsafe URL protocol handling (CVE-2026-110857).\n* python3.12-gitpython: Arbitrary code execution via path traversal (CVE-2026-78677).\n* python-gitpython: Arbitrary file read via Repo.archive() (CVE-2026-73619).\n* python3.12-pillow: Heap buffer overflow in ImagingJpegDecode (CVE-2026-112403).\n* python3.12-pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leading to code execution (CVE-2026-112398).\n* python3.12-pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (CVE-2026-112393).\n* python3.12-pillow: Denial of Service via unbounded recursion in the PDF parser (CVE-2026-112391).\n* python3.12-pillow: Denial of Service via unbounded memory expansion in MSP image decoder CVE-2026-112892\n* python3.12-pillow: Denial of Service via repeated EXIF headers CVE-2026-96643\n* python3.12-pillow: Denial of Service via duplicate page references in PDF files CVE-2026-96640\n* python3.12-pillow: Arbitrary code execution via JPEG encoder buffer overflow CVE-2026-96778\n* python3.12-pillow: Denial of Service via infinite loop during PDF page rewriting CVE-2026-112406\n* python3.12-pillow: Denial of Service via out-of-bounds read in TIFF decoding CVE-2026-112404\n* python3.12-pillow: Denial of Service via out-of-bounds read in TIFF encoder CVE-2026-112896\n* python3.12-pillow: Information disclosure via uninitialized buffer in TIFF decoding CVE-2026-112897\n* python3.12-pillow: Denial of Service via invalid pointer free during font rendering CVE-2026-112893\n* python3.12-pillow: Denial of Service via double free during image transformation CVE-2026-112402\n* python3.12-pillow: Denial of Service via crafted PDF during append operations CVE-2026-112895\n* python3.12-pillow: Denial of Service via crafted multi-frame image conversion CVE-2026-112894\n* python3.12-pillow: Denial of Service via memory exhaustion from crafted GIF image CVE-2026-112400\n* python3.12-pillow: Denial of Service via out-of-bounds memory access on zero-width images CVE-2026-112397\n* python3.12-pillow: Denial of Service via zero-size images in rank filters CVE-2026-112392\n* python3.12-pillow: Denial of Service via crafted APNG image CVE-2026-112399\n* python3.12-pillow: Denial of Service via null pointer dereference in Image merge CVE-2026-112405\n* python3.12-pillow: Denial of Service via infinite loop during crafted MIC image parsing CVE-2026-112390\n* python3.12-pillow: Denial of Service via unbounded recursion in PDF parser CVE-2026-112391\n* python3.12-brotli: Out-of-bounds write in the Google Brotli decoder (CVE-2026-111497).",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:92861",
        "url": "https://access.redhat.com/errata/RHSA-2026:92861"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92861.json"
      }
    ],
    "title": "Red Hat Security Advisory: Satellite 6.19 security update",
    "tracking": {
      "current_release_date": "2026-10-31T04:09:28+00:00",
      "generator": {
        "date": "2026-10-31T04:09:28+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:92861",
      "initial_release_date": "2026-10-29T21:37:34+00:00",
      "revision_history": [
        {
          "date": "2026-10-29T21:37:34+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-29T21:37:34+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-31T04:09:28+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.19 for RHEL 9",
                "product": {
                  "name": "Red Hat Satellite 6.19 for RHEL 9",
                  "product_id": "9Base-satellite-6.19",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6.19::el9"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.19 for RHEL 9",
                "product": {
                  "name": "Red Hat Satellite 6.19 for RHEL 9",
                  "product_id": "9Base-satellite-6.19-capsule",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite_capsule:6.19::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite 6"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openvox-agent-0:8.31.1-1.el9sat.src",
                "product": {
                  "name": "openvox-agent-0:8.31.1-1.el9sat.src",
                  "product_id": "openvox-agent-0:8.31.1-1.el9sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openvox-agent@8.31.1-1.el9sat?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openvox-server-0:8.17.0-1.el9sat.src",
                "product": {
                  "name": "openvox-server-0:8.17.0-1.el9sat.src",
                  "product_id": "openvox-server-0:8.17.0-1.el9sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openvox-server@8.17.0-1.el9sat?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-django-0:4.2.30-3.el9pc.src",
                "product": {
                  "name": "python3.12-django-0:4.2.30-3.el9pc.src",
                  "product_id": "python3.12-django-0:4.2.30-3.el9pc.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-django@4.2.30-3.el9pc?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
                "product": {
                  "name": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
                  "product_id": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-forwarder@0.1.1-1.el9sat?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-brotli-0:1.2.1-1.el9pc.src",
                "product": {
                  "name": "python3.12-brotli-0:1.2.1-1.el9pc.src",
                  "product_id": "python3.12-brotli-0:1.2.1-1.el9pc.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-brotli@1.2.1-1.el9pc?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-urllib3-0:2.8.0-1.el9pc.src",
                "product": {
                  "name": "python3.12-urllib3-0:2.8.0-1.el9pc.src",
                  "product_id": "python3.12-urllib3-0:2.8.0-1.el9pc.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-urllib3@2.8.0-1.el9pc?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
                "product": {
                  "name": "python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
                  "product_id": "python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-pulp-ansible@0.28.10-1.el9pc?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-gitpython-0:3.2.1-1.el9pc.src",
                "product": {
                  "name": "python3.12-gitpython-0:3.2.1-1.el9pc.src",
                  "product_id": "python3.12-gitpython-0:3.2.1-1.el9pc.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-gitpython@3.2.1-1.el9pc?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-pillow-0:13.0.0-1.el9pc.src",
                "product": {
                  "name": "python3.12-pillow-0:13.0.0-1.el9pc.src",
                  "product_id": "python3.12-pillow-0:13.0.0-1.el9pc.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-pillow@13.0.0-1.el9pc?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openvox-agent-0:8.31.1-1.el9sat.x86_64",
                "product": {
                  "name": "openvox-agent-0:8.31.1-1.el9sat.x86_64",
                  "product_id": "openvox-agent-0:8.31.1-1.el9sat.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openvox-agent@8.31.1-1.el9sat?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64",
                "product": {
                  "name": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64",
                  "product_id": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-forwarder@0.1.1-1.el9sat?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
                "product": {
                  "name": "python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
                  "product_id": "python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-brotli@1.2.1-1.el9pc?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
                "product": {
                  "name": "python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
                  "product_id": "python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-brotli-debugsource@1.2.1-1.el9pc?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
                "product": {
                  "name": "python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
                  "product_id": "python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-brotli-debuginfo@1.2.1-1.el9pc?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
                "product": {
                  "name": "python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
                  "product_id": "python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-pillow@13.0.0-1.el9pc?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
                "product": {
                  "name": "python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
                  "product_id": "python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-pillow-debugsource@13.0.0-1.el9pc?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
                "product": {
                  "name": "python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
                  "product_id": "python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-pillow-debuginfo@13.0.0-1.el9pc?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openvox-server-0:8.17.0-1.el9sat.noarch",
                "product": {
                  "name": "openvox-server-0:8.17.0-1.el9sat.noarch",
                  "product_id": "openvox-server-0:8.17.0-1.el9sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openvox-server@8.17.0-1.el9sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-django-0:4.2.30-3.el9pc.noarch",
                "product": {
                  "name": "python3.12-django-0:4.2.30-3.el9pc.noarch",
                  "product_id": "python3.12-django-0:4.2.30-3.el9pc.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-django@4.2.30-3.el9pc?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
                "product": {
                  "name": "python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
                  "product_id": "python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-urllib3@2.8.0-1.el9pc?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
                "product": {
                  "name": "python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
                  "product_id": "python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-pulp-ansible@0.28.10-1.el9pc?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
                "product": {
                  "name": "python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
                  "product_id": "python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-gitpython@3.2.1-1.el9pc?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openvox-agent-0:8.31.1-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src"
        },
        "product_reference": "openvox-agent-0:8.31.1-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openvox-agent-0:8.31.1-1.el9sat.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64"
        },
        "product_reference": "openvox-agent-0:8.31.1-1.el9sat.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openvox-server-0:8.17.0-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch"
        },
        "product_reference": "openvox-server-0:8.17.0-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openvox-server-0:8.17.0-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src"
        },
        "product_reference": "openvox-server-0:8.17.0-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-brotli-0:1.2.1-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src"
        },
        "product_reference": "python3.12-brotli-0:1.2.1-1.el9pc.src",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-brotli-0:1.2.1-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64"
        },
        "product_reference": "python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64"
        },
        "product_reference": "python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64"
        },
        "product_reference": "python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-django-0:4.2.30-3.el9pc.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch"
        },
        "product_reference": "python3.12-django-0:4.2.30-3.el9pc.noarch",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-django-0:4.2.30-3.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src"
        },
        "product_reference": "python3.12-django-0:4.2.30-3.el9pc.src",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-gitpython-0:3.2.1-1.el9pc.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch"
        },
        "product_reference": "python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-gitpython-0:3.2.1-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src"
        },
        "product_reference": "python3.12-gitpython-0:3.2.1-1.el9pc.src",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-pillow-0:13.0.0-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src"
        },
        "product_reference": "python3.12-pillow-0:13.0.0-1.el9pc.src",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-pillow-0:13.0.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64"
        },
        "product_reference": "python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64"
        },
        "product_reference": "python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        },
        "product_reference": "python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch"
        },
        "product_reference": "python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-pulp-ansible-1:0.28.10-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src"
        },
        "product_reference": "python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-urllib3-0:2.8.0-1.el9pc.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch"
        },
        "product_reference": "python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-urllib3-0:2.8.0-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src"
        },
        "product_reference": "python3.12-urllib3-0:2.8.0-1.el9pc.src",
        "relates_to_product_reference": "9Base-satellite-6.19-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openvox-agent-0:8.31.1-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src"
        },
        "product_reference": "openvox-agent-0:8.31.1-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openvox-agent-0:8.31.1-1.el9sat.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64"
        },
        "product_reference": "openvox-agent-0:8.31.1-1.el9sat.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openvox-server-0:8.17.0-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch"
        },
        "product_reference": "openvox-server-0:8.17.0-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openvox-server-0:8.17.0-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src"
        },
        "product_reference": "openvox-server-0:8.17.0-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-brotli-0:1.2.1-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src"
        },
        "product_reference": "python3.12-brotli-0:1.2.1-1.el9pc.src",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-brotli-0:1.2.1-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64"
        },
        "product_reference": "python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64"
        },
        "product_reference": "python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64"
        },
        "product_reference": "python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-django-0:4.2.30-3.el9pc.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch"
        },
        "product_reference": "python3.12-django-0:4.2.30-3.el9pc.noarch",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-django-0:4.2.30-3.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src"
        },
        "product_reference": "python3.12-django-0:4.2.30-3.el9pc.src",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-gitpython-0:3.2.1-1.el9pc.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch"
        },
        "product_reference": "python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-gitpython-0:3.2.1-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
        },
        "product_reference": "python3.12-gitpython-0:3.2.1-1.el9pc.src",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-pillow-0:13.0.0-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src"
        },
        "product_reference": "python3.12-pillow-0:13.0.0-1.el9pc.src",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-pillow-0:13.0.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64"
        },
        "product_reference": "python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64"
        },
        "product_reference": "python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        },
        "product_reference": "python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch"
        },
        "product_reference": "python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-pulp-ansible-1:0.28.10-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src"
        },
        "product_reference": "python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-urllib3-0:2.8.0-1.el9pc.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch"
        },
        "product_reference": "python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-urllib3-0:2.8.0-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
        },
        "product_reference": "python3.12-urllib3-0:2.8.0-1.el9pc.src",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src"
        },
        "product_reference": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
          "product_id": "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        },
        "product_reference": "yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.19"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-15307",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "discovery_date": "2026-08-04T17:01:22.074765+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511095"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Django. GeoDjango\u0027s spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally, it can be used to make outbound network requests, resulting in server-side request forgery.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "django: Django: Remote code execution via GeoDjango spatial lookups",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat products that are built with Django framework do not implement GeoDjango or GIS capabilities.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15307"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511095",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511095"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15307",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15307"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15307",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15307"
        },
        {
          "category": "external",
          "summary": "https://docs.djangoproject.com/en/dev/releases/security/",
          "url": "https://docs.djangoproject.com/en/dev/releases/security/"
        },
        {
          "category": "external",
          "summary": "https://github.com/django/django/commit/115ffd0463a765ab1cc93de18e94b5459b8a300e",
          "url": "https://github.com/django/django/commit/115ffd0463a765ab1cc93de18e94b5459b8a300e"
        },
        {
          "category": "external",
          "summary": "https://github.com/django/django/commit/208f80cb682868b584ed0a78f23e4ba6304212aa",
          "url": "https://github.com/django/django/commit/208f80cb682868b584ed0a78f23e4ba6304212aa"
        },
        {
          "category": "external",
          "summary": "https://github.com/django/django/commit/39b3e2d0c743a338def6c473086ebc06865e86b6",
          "url": "https://github.com/django/django/commit/39b3e2d0c743a338def6c473086ebc06865e86b6"
        },
        {
          "category": "external",
          "summary": "https://github.com/django/django/commit/f1949c1f9758947ade984c895ff16bef46f56520",
          "url": "https://github.com/django/django/commit/f1949c1f9758947ade984c895ff16bef46f56520"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/django-announce",
          "url": "https://groups.google.com/g/django-announce"
        },
        {
          "category": "external",
          "summary": "https://www.djangoproject.com/weblog/2026/aug/04/security-releases/",
          "url": "https://www.djangoproject.com/weblog/2026/aug/04/security-releases/"
        }
      ],
      "release_date": "2026-08-04T15:48:18.829000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "django: Django: Remote code execution via GeoDjango spatial lookups"
    },
    {
      "cve": "CVE-2026-18660",
      "cwe": {
        "id": "CWE-178",
        "name": "Improper Handling of Case Sensitivity"
      },
      "discovery_date": "2026-10-15T09:40:58.551187+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553134"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to bypass access controls and reach restricted resources. The issue occurs because the server and proxy components perform case-sensitive validation on host allowlists and denylists. By sending requests with altered character casing in the host name, an attacker can circumvent configured host filtering policies.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.eclipse.jetty/jetty-server: org.eclipse.jetty/jetty-proxy: Eclipse Jetty: Access control bypass via case-sensitive host filtering",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw allows an attacker to bypass host-based access control in Eclipse Jetty\u0027s server and proxy components. By varying the letter case of the Host header, requests can slip past configured host allow/deny lists, letting an attacker reach resources that virtual-host or proxy filtering was meant to block in affected Red Hat products that use jetty-server or jetty-proxy for this purpose.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18660"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553134",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553134"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18660",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18660"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18660",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18660"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-7wfj-j486-mxrf",
          "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-7wfj-j486-mxrf"
        },
        {
          "category": "external",
          "summary": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/212",
          "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/212"
        }
      ],
      "release_date": "2026-10-15T09:38:02.125000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "There is no mitigation for this issue other than applying the fix. As a temporary workaround, administrators who rely on Jetty host allow/deny filtering should add case-variant duplicates of every configured hostname to the filter lists, or enforce hostname case-normalization at an upstream load balancer or reverse proxy, until the update is installed.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.eclipse.jetty/jetty-server: org.eclipse.jetty/jetty-proxy: Eclipse Jetty: Access control bypass via case-sensitive host filtering"
    },
    {
      "cve": "CVE-2026-19203",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-09-08T12:33:32.310662+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2529768"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Jetty. A remote attacker can exploit this vulnerability by sending specially crafted HTTP/1.1 chunked requests. This can cause Jetty and an intermediary proxy to interpret different request boundaries, potentially leading to HTTP request smuggling. This issue arises from Jetty\u0027s acceptance of a lone Line Feed (LF) character as a terminator during chunked request parsing.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Jetty in affected Red Hat products may permit remote, unauthenticated HTTP request smuggling when specially crafted HTTP/1.1 chunked requests traverse an intermediary that interprets request boundaries differently. Jetty 12.1 uses RFC 9110 compliance by default and is not affected unless configured to use legacy RFC 7230 or RFC 2616 compliance modes. Remediation is being pursued for vulnerable shipped versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19203"
        },
        {
          "category": "external",
          "summary": "RHBZ#2529768",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529768"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19203",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19203"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19203",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19203"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h",
          "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h"
        }
      ],
      "release_date": "2026-09-08T12:08:37.576000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests"
    },
    {
      "cve": "CVE-2026-56853",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:14:53.561638+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: Unencrypted HTTP/2 servers are susceptible to a denial of service due to improper handling of ReadHeaderTimeout during the client preface reading phase. This can lead to resource exhaustion and service unavailability in affected Red Hat products configured to support unencrypted HTTP/2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56853",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/795540",
          "url": "https://go.dev/cl/795540"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80205",
          "url": "https://go.dev/issue/80205"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6089",
          "url": "https://pkg.go.dev/vuln/GO-2026-6089"
        }
      ],
      "release_date": "2026-08-13T21:58:53.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "cve": "CVE-2026-59646",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-08-03T02:01:09.336839+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510193"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Bouncy Castle for Java. The DTLS (Datagram Transport Layer Security) handshake reassembler allocates buffers based on an unchecked 24-bit length value. A remote attacker could exploit this vulnerability by sending a specially crafted DTLS handshake message, leading to excessive memory allocation and a denial of service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.bouncycastle/bc-java: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service via unchecked DTLS handshake reassembler buffer allocation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw has an Important impact. Bouncy Castle for Java\u0027s DTLS handshake reassembler allocates a buffer from an unchecked 24-bit length field, so a remote, unauthenticated attacker who sends a specially crafted DTLS handshake message can force excessive memory allocation and cause a denial of service. Only the Bouncy Castle TLS module (bctls) contains the affected code; Red Hat products that ship only the core provider (bcprov) or other Bouncy Castle modules are not affected. Within Red Hat\u0027s portfolio, the vulnerable module is bundled by Red Hat Fuse (via Apache CXF) and Red Hat Satellite.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59646"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510193",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510193"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59646",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59646"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59646",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59646"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/commit/2d98721e71bbd822ffa0f84e088eea645cf679fa",
          "url": "https://github.com/bcgit/bc-java/commit/2d98721e71bbd822ffa0f84e088eea645cf679fa"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/commit/2ea38942c7917f6d7ab4de93d8a5336d021df0d9",
          "url": "https://github.com/bcgit/bc-java/commit/2ea38942c7917f6d7ab4de93d8a5336d021df0d9"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-59646",
          "url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-59646"
        }
      ],
      "release_date": "2026-08-03T00:48:29.386000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.bouncycastle/bc-java: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service via unchecked DTLS handshake reassembler buffer allocation"
    },
    {
      "cve": "CVE-2026-68497",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2026-09-11T16:01:15.919616+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531964"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service (DoS) by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` fields from JSON strings, where the system processes arbitrarily long numeric components. This can lead to high CPU utilization, potentially saturating server worker threads and making the service unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw in jackson-databind allows remote attackers to consume excessive CPU by submitting specially crafted JSON with unbounded numeric values, causing a denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68497"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531964",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531964"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68497",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68497"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd",
          "url": "https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/pull/6127",
          "url": "https://github.com/FasterXML/jackson-databind/pull/6127"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"
        }
      ],
      "release_date": "2026-09-11T15:49:30.366000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing"
    },
    {
      "cve": "CVE-2026-73619",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-08-13T11:53:43.512678+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515265"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GitPython. This vulnerability allows an attacker to read arbitrary files from the filesystem. By exploiting an incomplete denylist in the `unsafe_git_archive_options` guard, an attacker can supply specific options, such as `--add-file` or `--add-virtual-file`, to the `Repo.archive()` function. This leads to unauthorized information disclosure at the privileges of the process running GitPython.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gitpython: GitPython: Arbitrary file read vulnerability via `Repo.archive()`",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a Moderate impact flaw in GitPython that allows an attacker to read arbitrary files from the filesystem. The vulnerability arises from an incomplete denylist in the `unsafe_git_archive_options` guard, which can be bypassed by supplying specific options to the `Repo.archive()` function. This could lead to unauthorized information disclosure in Red Hat products utilizing affected versions of GitPython, such as Red Hat OpenStack Platform and Red Hat Satellite.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73619"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515265",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515265"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73619",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73619"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73619",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73619"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr",
          "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-archive",
          "url": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-archive"
        }
      ],
      "release_date": "2026-08-13T11:28:20.737000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gitpython: GitPython: Arbitrary file read vulnerability via `Repo.archive()`"
    },
    {
      "cve": "CVE-2026-78667",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:00:51.418048+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548334"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service (DoS) by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU resources, rendering the application unresponsive to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated with an Important severity for Red Hat products because an unauthenticated remote attacker can exhaust server compute resources over the network, leading to a complete service outage. Across Red Hat enterprise environments, Go is widely deployed in container runtimes, monitoring daemons, and OpenShift infrastructure components. However, exploitation is restricted to applications that actively listen on the network and serve content using standard library HTTP handlers that process multi-range requests. CLI utilities and server components that do not handle byte-range requests from untrusted clients remain unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78667"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548334",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548334"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78667",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78667"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78667",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78667"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847309",
          "url": "https://go.dev/cl/847309"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81858",
          "url": "https://go.dev/issue/81858"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6609",
          "url": "https://pkg.go.dev/vuln/GO-2026-6609"
        }
      ],
      "release_date": "2026-10-08T22:53:59.148000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers"
    },
    {
      "cve": "CVE-2026-78669",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:01:28.964317+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548344"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service (DoS) by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration (SETTINGS) frames that modify window sizes, an attacker forces the system into intensive state processing. This resource exhaustion degrades performance and can render the service unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the Go net/http package and the golang.org/x/net/http2 module. A malicious HTTP/2 peer can cause excessive CPU consumption by opening a large number of HTTP/2 streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. Each SETTINGS frame forces the server or client to iterate over all open streams to adjust their flow-control windows, resulting in quadratic CPU usage and denial of service.\n\nThis vulnerability affects all Go programs that serve or consume HTTP/2 traffic using net/http or golang.org/x/net/http2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78669"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548344",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548344"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78669",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78669"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78669",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78669"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847186",
          "url": "https://go.dev/cl/847186"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847308",
          "url": "https://go.dev/cl/847308"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81742",
          "url": "https://go.dev/issue/81742"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs",
          "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6611",
          "url": "https://pkg.go.dev/vuln/GO-2026-6611"
        }
      ],
      "release_date": "2026-10-08T22:53:59.530000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "In case you consume HTTP2, upgrade to a patched version of the http module.\n\nVerify:\n```\ngo version\ngo list -m golang.org/x/net\ngovulncheck ./...\n```",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames"
    },
    {
      "cve": "CVE-2026-78677",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-08-25T01:53:26.192779+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2523215"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GitPython. This vulnerability allows a remote attacker to create arbitrary Git directories outside the intended clone destination. By manipulating the `separate_git_dir` parameter during repository cloning, an attacker can redirect repository metadata to an attacker-controlled filesystem path. This could lead to arbitrary directory creation and potentially enable the execution of malicious code through Git hooks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "GitPython: GitPython: Arbitrary Code Execution via Path Traversal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has identified a path traversal vulnerability in GitPython versions before 3.1.59. The vulnerability arises because the `--separate-git-dir` option is not included in the `unsafe_git_clone_options` denylist, allowing attackers who control the `separate_git_dir` parameter during repository cloning to redirect Git repository metadata to arbitrary filesystem locations outside the intended clone destination. This can lead to arbitrary directory and file creation bounded only by process permissions. When combined with subsequent Git operations that trigger hook execution on the redirected repository, this vulnerability can escalate to arbitrary code execution. Exploitation requires that the application passes untrusted, attacker-controlled input to the `separate_git_dir` keyword argument of `Repo.clone_from()` or `Repo.clone()` methods without proper validation, while the `allow_unsafe_options` parameter remains at its default value of False.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78677"
        },
        {
          "category": "external",
          "summary": "RHBZ#2523215",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523215"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78677",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78677"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78677",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78677"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc",
          "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir",
          "url": "https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir"
        }
      ],
      "release_date": "2026-08-25T01:30:34.719000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, upgrade to GitPython version 3.1.59 or later, which correctly includes `--separate-git-dir` in the unsafe options denylist. If upgrading is not immediately possible, ensure that the `separate_git_dir` parameter is never populated from untrusted or user-controlled sources. Applications should validate and sanitize any input before passing it to GitPython cloning methods, or avoid exposing the `separate_git_dir` parameter to external callers entirely.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "GitPython: GitPython: Arbitrary Code Execution via Path Traversal"
    },
    {
      "cve": "CVE-2026-84445",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-09-14T16:22:17.356407+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533175"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer() can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a Denial of Service (DoS). In some deployments, this attack can be unauthenticated.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity impact because an unauthenticated remote client can crash the host daemon, causing an immediate denial of service across exposed endpoints. The issue specifically threatens deployments utilizing xDS-managed gRPC servers, as requests that omit standard routing authority parameters cause the application to crash on an unhandled slice lookup. Standard gRPC server implementations that do not configure xDS control plane routing are not susceptible to this failure mode. Furthermore, in environments enforcing mutual transport layer security (mTLS), successful transport authentication is required before reaching the vulnerable routing stage, restricting potential exploitation to authenticated peers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533175",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533175"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84445",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84445",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7",
          "url": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4",
          "url": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f",
          "url": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/issues/9354",
          "url": "https://github.com/grpc/grpc-go/issues/9354"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/pull/9365",
          "url": "https://github.com/grpc/grpc-go/pull/9365"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/pull/9366",
          "url": "https://github.com/grpc/grpc-go/pull/9366"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/pull/9367",
          "url": "https://github.com/grpc/grpc-go/pull/9367"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2",
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2",
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj",
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"
        }
      ],
      "release_date": "2026-09-14T16:11:41.401000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests"
    },
    {
      "cve": "CVE-2026-87819",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-09-09T11:31:19.834714+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2530742"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GitPython. A remote attacker could exploit a regular expression denial of service (ReDoS) vulnerability by crafting a malicious commit object. Specifically, a malformed author field containing an unterminated angle bracket can cause excessive processing, leading to the exhaustion of CPU resources and a denial of service for over two minutes per commit access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "GitPython: GitPython: Denial of Service via crafted commit author field",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A regular expression denial of service vulnerability was found in GitPython when processing commit author and committer fields. The Actor.name_email_regex pattern exhibits quadratic backtracking when encountering malformed author fields containing unterminated angle brackets. An attacker who can introduce a crafted commit object into a repository that is subsequently processed by a GitPython application can cause excessive CPU resource consumption, leading to denial of service for over two minutes per commit access. This requires the application to parse commits from untrusted sources such as public git servers, tarballs, or automated import tools.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-87819"
        },
        {
          "category": "external",
          "summary": "RHBZ#2530742",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530742"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-87819",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-87819"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87819",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87819"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx",
          "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos",
          "url": "https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos"
        }
      ],
      "release_date": "2026-09-09T11:21:05.360000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "Update GitPython to version 3.1.60 or later. Validate and sanitize git repository sources before processing. Enable git fsck validation (receive.fsckObjects) on git servers to reject malformed commit objects. Implement length limits on commit metadata fields before processing.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "GitPython: GitPython: Denial of Service via crafted commit author field"
    },
    {
      "cve": "CVE-2026-89407",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-09-22T20:07:47.987231+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2538720"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-core. An attacker can supply specially crafted JSON that, when deserialized into a numeric target type, triggers a Regular expression Denial of Service (ReDoS) vulnerability. This occurs due to quadratic backtracking in the NumberInput.looksLikeValidNumber() method\u0027s PATTERN_FLOAT regular expression. A small number of concurrent requests with a long input string can exhaust a server\u0027s request-handling thread pool, leading to a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact because while remote actors can induce CPU starvation to trigger a denial of service, the issue affects availability only without granting unauthorized access or data tampering capabilities. In Red Hat environments, exposure depends on services deserializing untrusted JSON payloads into numeric Java object types where default string coercion occurs. Older releases packaging jackson-core versions prior to 2.17.0 do not include the vulnerable pattern matching logic and are unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-89407"
        },
        {
          "category": "external",
          "summary": "RHBZ#2538720",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538720"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-89407",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-89407"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89407",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89407"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/issues/1649",
          "url": "https://github.com/FasterXML/jackson-core/issues/1649"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/pull/1650",
          "url": "https://github.com/FasterXML/jackson-core/pull/1650"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/pull/1701",
          "url": "https://github.com/FasterXML/jackson-core/pull/1701"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89",
          "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89"
        }
      ],
      "release_date": "2026-09-22T14:53:20.999000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking"
    },
    {
      "cve": "CVE-2026-89425",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-09-23T02:30:57.997196+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539084"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FasterXML jackson-core. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted, malformed token to the JsonFactory.createParser(DataInput) method. The UTF8DataInputJsonParser component, responsible for handling DataInput sources, does not properly limit the size of the error message generated for invalid tokens. This unbounded growth of the StringBuilder can consume excessive memory, leading to an OutOfMemoryError and crashing the Java Virtual Machine (JVM).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A denial of service flaw exists in FasterXML jackson-core where processing malformed JSON tokens from a DataInput source can lead to unbounded memory allocation. This vulnerability can exhaust system resources, causing a Java Virtual Machine (JVM) crash and impacting the availability of services that utilize the affected JsonFactory.createParser(DataInput) method with untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-89425"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539084",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539084"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-89425",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-89425"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/pull/1698",
          "url": "https://github.com/FasterXML/jackson-core/pull/1698"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf",
          "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"
        }
      ],
      "release_date": "2026-09-23T02:06:10.571000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing"
    },
    {
      "cve": "CVE-2026-94440",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:01:17.316758+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548341"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mime/multipart and net/textproto packages in Go. A remote attacker could exploit this vulnerability by submitting a crafted multipart form request that bypasses configured memory limits when the remaining boundary limit is small. This issue allows the application to read an arbitrarily long line into memory, leading to excessive resource consumption and a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having a Moderate severity for Red Hat products because, while an unauthenticated remote attacker can trigger excessive memory consumption leading to a denial of service, exploitation cannot lead to code execution or information disclosure. The issue specifically threatens Go-based services and daemons that accept and process incoming multipart HTTP form payloads. Applications built with Go that do not expose web interfaces or parse multipart request streams are unaffected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94440"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548341",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548341"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94440",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94440"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94440",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94440"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847307",
          "url": "https://go.dev/cl/847307"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81741",
          "url": "https://go.dev/issue/81741"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6608",
          "url": "https://pkg.go.dev/vuln/GO-2026-6608"
        }
      ],
      "release_date": "2026-10-08T22:53:58.959000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing"
    },
    {
      "cve": "CVE-2026-96640",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-21T21:25:20.244307+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2558576"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. When appending images to an existing PDF document, the PDF parser does not track duplicate indirect references within the page structure. A remote attacker can provide a specially crafted PDF file containing repeated references to the same page nodes, causing the application to process an exponential number of pages. This can consume excessive CPU resources, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: pillow: Denial of Service via duplicate page references in PDF files",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-96640"
        },
        {
          "category": "external",
          "summary": "RHBZ#2558576",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558576"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-96640",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96640"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96640",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96640"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7",
          "url": "https://github.com/python-pillow/Pillow/commit/6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/10093",
          "url": "https://github.com/python-pillow/Pillow/pull/10093"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-mrfp-p49p-3hf2",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-mrfp-p49p-3hf2"
        }
      ],
      "release_date": "2026-10-21T21:03:22.785000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: pillow: Denial of Service via duplicate page references in PDF files"
    },
    {
      "cve": "CVE-2026-96643",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-10-21T21:03:21.143962+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2558566"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. When processing a specially crafted image with repeated Exchangeable Image File Format (EXIF) metadata headers, the library repeatedly copies and parses the data. A remote attacker could exploit this vulnerability by providing a malicious image file to an application that processes image metadata, causing excessive CPU consumption that results in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: pillow: Denial of Service via repeated EXIF headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as having an Important severity because remote, unauthenticated attackers can cause severe denial of service by submitting crafted images to automated image-processing pipelines. Services utilizing Pillow to inspect metadata or perform operations such as orientation adjustments can experience quadratic CPU consumption when parsing repetitive header markers. Because this condition can be triggered remotely without privileges in standard image handling workflows, it poses an elevated availability risk to backend services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-96643"
        },
        {
          "category": "external",
          "summary": "RHBZ#2558566",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558566"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-96643",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96643"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96643",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96643"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/806e38381c781f32bbd22f4cd026678acd40fd6c",
          "url": "https://github.com/python-pillow/Pillow/commit/806e38381c781f32bbd22f4cd026678acd40fd6c"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/10073",
          "url": "https://github.com/python-pillow/Pillow/pull/10073"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g4qv-2jxx-769h",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g4qv-2jxx-769h"
        }
      ],
      "release_date": "2026-10-21T20:56:26.344000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: pillow: Denial of Service via repeated EXIF headers"
    },
    {
      "cve": "CVE-2026-96778",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-10-21T21:06:07.880492+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2558567"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. A remote attacker could exploit a heap buffer overflow vulnerability to achieve arbitrary code execution or cause a Denial of Service (DoS). This issue occurs when an application re-encodes an untrusted image into JPEG format while preserving specially crafted color profile and comment metadata, causing an internal memory buffer to overflow. Successful exploitation allows adjacent memory to be overwritten, which can crash the application or permit code execution in suitable runtime environments.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat evaluates this vulnerability as having an Important severity because an unauthenticated attacker could trigger memory corruption leading to denial of service or arbitrary code execution if an exposed service processes untrusted graphics. In Red Hat ecosystems, Pillow is bundled across various containerized environments, including Red Hat OpenShift AI and Ansible Automation Platform, where background services or pipelines may ingest media files. However, exploitation requires an application workflow that explicitly re-encodes user-supplied images into JPEG format while retaining both embedded color profiles and comment metadata, which restricts the attack surface to specific image handling operations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-96778"
        },
        {
          "category": "external",
          "summary": "RHBZ#2558567",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558567"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-96778",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96778"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96778",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96778"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/02561b8dc6117d5670d4b469fecdd02c70854f9b",
          "url": "https://github.com/python-pillow/Pillow/commit/02561b8dc6117d5670d4b469fecdd02c70854f9b"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/10124",
          "url": "https://github.com/python-pillow/Pillow/pull/10124"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g7cr-3p24-7wf7",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g7cr-3p24-7wf7"
        }
      ],
      "release_date": "2026-10-21T20:58:24.238000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow"
    },
    {
      "cve": "CVE-2026-97031",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:00:59.284728+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548336"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in crypto/tls. A remote attacker can trigger this vulnerability by sending a specially crafted packet containing multiple Encrypted Client Hello (ECH) outer extension references to a server. Processing these unauthorized references leads to excessive memory consumption, causing a Denial of Service (DoS) through server crashes or unresponsiveness.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can trigger memory exhaustion and crash server processes without requiring privileges or user interaction. Go applications that terminate TLS connections and accept Encrypted Client Hello configurations are vulnerable to resource amplification during the initial handshake. While the flaw does not facilitate arbitrary code execution or compromise data confidentiality, the resulting denial of service can disrupt critical network services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97031"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548336",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548336"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97031",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97031"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97031",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97031"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847312",
          "url": "https://go.dev/cl/847312"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81855",
          "url": "https://go.dev/issue/81855"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6607",
          "url": "https://pkg.go.dev/vuln/GO-2026-6607"
        }
      ],
      "release_date": "2026-10-08T22:53:58.775000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references"
    },
    {
      "cve": "CVE-2026-97687",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-09-29T15:44:25.449046+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543255"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security (TLS) settings inadvertently overwrite the proxy\u0027s TLS configuration, which can disable certificate verification on reused connection contexts. Consequently, an attacker can impersonate the proxy to monitor or modify forwarded traffic or capture client credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability as having an Important impact because a network attacker can exploit corrupted TLS validation states to impersonate an HTTPS proxy, enabling complete interception and manipulation of sensitive communications as well as client credential theft. Successful exploitation depends on specialized application architectures where outgoing requests utilize an HTTPS-capable proxy alongside customized destination TLS parameters that inadvertently override proxy verification. Default Red Hat enterprise deployments that communicate directly with endpoints, utilize traditional HTTP proxies, or rely on standard CONNECT tunneling for end-to-end encryption do not expose this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97687"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543255",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543255"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97687",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97687"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97687",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97687"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465",
          "url": "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3",
          "url": "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/pull/5093",
          "url": "https://github.com/urllib3/urllib3/pull/5093"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/releases/tag/2.8.0",
          "url": "https://github.com/urllib3/urllib3/releases/tag/2.8.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"
        }
      ],
      "release_date": "2026-09-29T15:30:27.136000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override"
    },
    {
      "cve": "CVE-2026-97689",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-29T15:41:38.807723+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543245"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3. This flaw allows a Denial of Service (DoS) through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important impact because an untrusted remote server can trigger process crashes and complete denial of service across client applications without requiring authentication or special privileges. In Red Hat environments, urllib3 is integrated across numerous system tools, container workloads, and platform services to handle outbound web communication. The risk specifically manifests when these services process streamed replies from potentially malicious third-party endpoints, whereas workloads restricted to internal or verified infrastructure remain largely unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97689"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543245",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543245"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97689",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97689"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97689",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97689"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed",
          "url": "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/releases/tag/2.8.0",
          "url": "https://github.com/urllib3/urllib3/releases/tag/2.8.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw"
        }
      ],
      "release_date": "2026-09-29T15:36:05.963000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser"
    },
    {
      "cve": "CVE-2026-110856",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-10-14T23:02:28.242131+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2552977"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GitPython. A remote attacker can trigger a Denial of Service (DoS) by providing a malicious repository containing commit or tag objects with long, space-filled lines lacking a valid timestamp or timezone. When parsing these lines, the regular expression pattern triggers quadratic backtracking, leading to high CPU consumption and causing the application to become unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "GitPython: GitPython: Denial of Service via regular expression backtracking in date parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important severity because Red Hat services and containerized environments that ingest remote repositories can be exposed to sustained service outages without requiring administrative privileges or local system access. When an integration processes a repository that includes specifically structured author or tag metadata, the regex evaluation experiences severe resource exhaustion, stalling worker processes. While this defect disrupts service availability across automation workflows and analysis pipelines, it does not allow unauthorized data access or arbitrary code execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110856"
        },
        {
          "category": "external",
          "summary": "RHBZ#2552977",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552977"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110856",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110856"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110856",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110856"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-m64x-33q8-m5h7",
          "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-m64x-33q8-m5h7"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/gitpython-before-3.2.0-redos-via-re-actor-epoch-in-parse-actor-and-date",
          "url": "https://www.vulncheck.com/advisories/gitpython-before-3.2.0-redos-via-re-actor-epoch-in-parse-actor-and-date"
        }
      ],
      "release_date": "2026-10-14T22:52:38.541000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "GitPython: GitPython: Denial of Service via regular expression backtracking in date parsing"
    },
    {
      "cve": "CVE-2026-110857",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "discovery_date": "2026-10-14T23:01:39.302092+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2552966"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GitPython. A remote attacker can achieve arbitrary code execution by supplying specially crafted repository URLs that are processed without proper protocol validation. Because the library forwards untrusted URLs and input parameters to the underlying Git utility without adequate sanitization, an attacker can execute arbitrary system commands within the context of the host application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "GitPython: GitPython: Arbitrary code execution via unsafe URL protocol handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having an Important impact for Red Hat products because an attacker capable of supplying unvalidated repository sources to automated platform tasks could achieve arbitrary code execution under the privileges of the executing service. While default configurations in modern underlying git tools restrict dangerous external transport helpers, environments operating on older platform stacks or custom configurations that permit extended transport protocols face elevated exposure. Exploitation is constrained to scenarios where the host application processes untrusted repository references or user-supplied command arguments without prior sanitization.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110857"
        },
        {
          "category": "external",
          "summary": "RHBZ#2552966",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552966"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110857",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110857"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110857",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110857"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-w8jc-g24h-crhw",
          "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-w8jc-g24h-crhw"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/gitpython-before-3.2.0-command-execution-via-ls-remote-ext-urls",
          "url": "https://www.vulncheck.com/advisories/gitpython-before-3.2.0-command-execution-via-ls-remote-ext-urls"
        }
      ],
      "release_date": "2026-10-14T22:52:40.373000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "GitPython: GitPython: Arbitrary code execution via unsafe URL protocol handling"
    },
    {
      "cve": "CVE-2026-110858",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "discovery_date": "2026-10-14T23:01:05.434947+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2552959"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GitPython. This vulnerability allows an attacker to achieve arbitrary code execution on the host system. The issue occurs because the Remote.pull() function inspects only keyword arguments for unsafe command options and fails to validate positional repository reference specifications (refspecs). By supplying crafted refspecs containing command-line flags, an attacker can execute arbitrary operating system commands with the privileges of the calling process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "GitPython: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is evaluated as having Critical impact because successful exploitation enables unauthenticated remote code execution with the full privileges of the host service whenever untrusted repository reference strings are processed. In Red Hat environments such as Ansible Automation Platform and OpenShift AI, GitPython manages automated repository synchronization workflows that may become exposed if external inputs govern branch definitions. However, execution is contingent on using SSH or local filesystem transports, whereas interactions strictly using HTTPS remotes render the injected parameters inert.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2552959",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552959"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110858"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-f9j4-qggq-h239",
          "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-f9j4-qggq-h239"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/gitpython-3.1.30-before-3.2.0-command-injection-via-remote-pull-refspec",
          "url": "https://www.vulncheck.com/advisories/gitpython-3.1.30-before-3.2.0-command-injection-via-remote-pull-refspec"
        }
      ],
      "release_date": "2026-10-14T22:52:42.217000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "GitPython: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec"
    },
    {
      "cve": "CVE-2026-110859",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "discovery_date": "2026-10-14T23:03:29.261426+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2552989"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GitPython. An argument injection vulnerability in the branch checkout mechanism allows a remote attacker to read arbitrary files from the host system. By enticing an application to clone and check out a repository with a specially crafted branch name, an attacker can cause command error messages to disclose sensitive local file contents.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "GitPython: GitPython: Arbitrary file read via argument injection in branch checkout",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity impact because unauthenticated remote attackers can read sensitive system files with no prior privileges if a service is directed to clone an untrusted repository. In Red Hat environments such as Ansible Automation Platform, Satellite, and OpenShift AI, automated workflows frequently retrieve and synchronize external Git sources. When an affected service processes an untrusted repository containing a specially manipulated reference name, local host files can be exposed via returned error diagnostics.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110859"
        },
        {
          "category": "external",
          "summary": "RHBZ#2552989",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552989"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110859",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110859"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110859",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110859"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-23mf-xhv8-69c2",
          "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-23mf-xhv8-69c2"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/gitpython-before-3.2.0-arbitrary-file-read-via-head-checkout-branch-name",
          "url": "https://www.vulncheck.com/advisories/gitpython-before-3.2.0-arbitrary-file-read-via-head-checkout-branch-name"
        }
      ],
      "release_date": "2026-10-14T22:52:43.585000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "GitPython: GitPython: Arbitrary file read via argument injection in branch checkout"
    },
    {
      "cve": "CVE-2026-111497",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-10-22T13:42:58.596140+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2558973"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or potentially arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brotli: Out-of-Bounds Write in Google Brotli Decoder",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Important. Exploitation requires that the target decompress attacker-controlled Brotli data (for example HTTP content negotiated with Content-Encoding: br, or APIs such as Node.js zlib / fetch() that decode Brotli). The vulnerable path is reached with a malformed stream rather than typical well-formed encoder output, and there is no public, reliable remote code execution proof-of-concept. Red Hat Enterprise Linux compiler and runtime hardenings - including Address Space Layout Randomization (ASLR), Non-eXecutable (NX) memory, FORTIFY_SOURCE, and SELinux - increase the difficulty of turning this memory corruption into reliable code execution, though they do not eliminate crashes or all impact. Combined with the Attack Requirements noted by the CNA (CVSS v4 AT:P), Red Hat scores Attack Complexity as High and rates the flaw Important rather than Critical.\n\n---\n\nThe Node.js packages in Red Hat Enterprise Linux use either system version of brotli or bundled version. Some Node.js versions are marked \"Not affected\" because they utilize system brotli. For these versions, the Node.js package itself does not require updating. However, customers must still update the system brotli/libbrotli package to address the vulnerability for these Node.js installations.\n\nFollowing is the overview of Node.js versions use system or bundled version.\n\n- Node.js 22 in Red Hat Enterprise Linux 8 and 9, provided via nodejs:22 module, uses system brotli.\n- Node.js 24 in Red Hat Enterprise Linux 8 and 9, provided via nodejs:24 modules, use bundled brotli.\n- Node.js 22 and 24 in Red Hat Enterprise Linux 10, provided via nodejs22 and nodejs24 use system brotli.\n\n---\n\nThe .NET packages in Red Hat Enterprise Linux may either use system version of brotli or bundled version. Following is the overview of .NET versions use system or bundled version.\n\n- .NET 8.0 in Red Hat Enterprise Linux 8, 9, and 10, provided via dotnet8.0 packages, use bundled brotli.\n- .NET 9.0, 10.0, and 11.0 in Red Hat Enterprise Linux 8, 9, and 10, provided via dotnet9.0, dotnet10.0, and dotnet11.0 packages, use system brotli.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-111497"
        },
        {
          "category": "external",
          "summary": "RHBZ#2558973",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558973"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-015",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-015"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-111497",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-111497"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high",
          "url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2026-10-22T13:35:41.975000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2026-10-27T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder"
    },
    {
      "cve": "CVE-2026-111943",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-20T09:38:36.160000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556068"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important because Go applications validating TLS certificates could accept unauthorized certificates issued by distrusted intermediate Certificate Authorities, potentially compromising the integrity and confidentiality of secure network communications. Any Go-based client or server relying on standard certificate verification may be exposed to man-in-the-middle attacks if an attacker intercepts traffic using certificates derived from these intermediate keys. Exploitation requires specific network positioning and certificates generated by the untrusted intermediate authorities, limiting opportunistic widespread abuse.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556068",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556068"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-012",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-111943",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111943",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/go/issues/82345",
          "url": "https://github.com/golang/go/issues/82345"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU",
          "url": "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6809",
          "url": "https://pkg.go.dev/vuln/GO-2026-6809"
        }
      ],
      "release_date": "2026-10-20T02:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates"
    },
    {
      "cve": "CVE-2026-112390",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-10-19T20:51:58.037704+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555848"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted Microsoft Image Composer (MIC) file. When an application attempts to count or extract frames from the malicious image, an improper state reset triggers an infinite loop. This non-advancing loop consumes excessive CPU resources and can hang application worker processes indefinitely.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can induce an infinite loop, exhausting worker CPU resources and resulting in a denial of service for applications handling untrusted image data. Within Red Hat environments, Pillow is deployed across numerous container images, machine learning frameworks, and automated backend services. Exploitation requires the optional olefile dependency to be present to register the Microsoft Image Composer format handler, and specifically targets workflows that query frame counts or process multi-frame images. Environments that do not inspect frame counts or do not have olefile installed are not vulnerable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112390"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555848",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555848"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112390",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112390"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112390",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112390"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218",
          "url": "https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9"
        }
      ],
      "release_date": "2026-10-19T20:35:39.189000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing"
    },
    {
      "cve": "CVE-2026-112391",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-19T20:52:51.473281+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555851"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. The PDF parser fails to limit recursion depth when reading nested PDF data structures such as arrays and dictionaries. A remote attacker could exploit this vulnerability by supplying a specially crafted, deeply nested PDF file to an application processing PDFs in append mode. This causes excessive recursion that crashes or terminates the worker process, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: Pillow: Denial of Service via unbounded recursion in PDF parser",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability as having Important severity because an unauthenticated remote attacker could cause worker process termination and denial of service by submitting maliciously structured input files. However, exploitation is constrained to specific deployment workflows where an application utilizes Pillow to append image data onto preexisting, untrusted PDF documents. Systems and services that only process standard raster image formats or do not manipulate external PDF files in append mode are unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112391"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555851",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555851"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112391",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112391"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112391",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112391"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/94cb11c44ff7345414da17ebfea1598a529ad9cd",
          "url": "https://github.com/python-pillow/Pillow/commit/94cb11c44ff7345414da17ebfea1598a529ad9cd"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-254f-3936-288h",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-254f-3936-288h"
        }
      ],
      "release_date": "2026-10-19T20:40:36.285000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce recursion depth limits in PdfParser when reading nested PDF data structures during append operations: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which set default max_nesting parameter to 900 instead of -1 in get_value() and read_indirect() to enforce recursion limits, closing all 2 injection vectors (deeply nested PDF arrays, deeply nested PDF dictionaries). Until patched, this is a concern on applications using Pillow to append images to existing, untrusted PDF files, so prevent untrusted users from submitting PDF files to applications executing image saves with PDF append enabled. As a compensating measure, configure service watchdogs and automatic restart policies such as systemd WatchdogSec and Restart to restart workers that terminate due to uncaught RecursionError exceptions. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded recursion defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1204 Service Watchdog and Automatic Restart (systemd WatchdogSec/Restart) (medium)",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: Pillow: Denial of Service via unbounded recursion in PDF parser"
    },
    {
      "cve": "CVE-2026-112392",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-10-19T21:21:52.403747+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555866"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. An attacker can cause a Denial of Service (DoS) by submitting a zero-size image to an application that applies rank-based filters, such as median, minimum, or maximum filters. When attempting to expand the image borders, Pillow reads from unallocated image storage, resulting in an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: pillow: Denial of Service via zero-size images in rank filters",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has rated this vulnerability as having an impact of Important because an unauthenticated remote attacker can crash backend application processes handling image transformations without requiring elevated privileges. In Red Hat environments deploying services with Pillow, processing untrusted image inputs or crop coordinates using rank-derived filtering routines can lead to service interruption. However, the scope of impact is confined strictly to process termination resulting from an invalid memory dereference, with no evidence of memory corruption or confidentiality exposure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112392"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555866",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555866"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112392",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112392"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112392",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112392"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/443e3130a8c11594fd0e296afad497e11e678961",
          "url": "https://github.com/python-pillow/Pillow/commit/443e3130a8c11594fd0e296afad497e11e678961"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hc",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hc"
        }
      ],
      "release_date": "2026-10-19T21:17:18.908000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to validate image dimensions and reject zero-width or zero-height inputs before invoking rank, median, minimum, or maximum filters in Pillow: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which check if imIn-\u003exsize or imIn-\u003eysize is zero in ImagingExpand(), allocate a new image, copy palette data, and return early without performing line expansion, closing all 3 injection vectors (multi-page TIFFs with zero-dimension secondary IFDs, image crops with identical edge boundaries resulting in zero dimensions, zero-width or zero-height input images). Until patched, this is a concern on Applications accepting untrusted images or crop parameters that process zero-dimension images through rank-based filters, so Validate and reject zero-dimension images or identical crop coordinates prior to passing image objects to rank-based filtering routines. These controls limit blast radius and contain exploitation, but they do not fix the underlying NULL pointer dereference defect \u2014 apply the upstream patch to fully remediate.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: pillow: Denial of Service via zero-size images in rank filters"
    },
    {
      "cve": "CVE-2026-112393",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-10-19T20:51:29.035172+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555846"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. When saving compressed Tagged Image File Format (TIFF) images into memory buffers rather than direct files, the library incorrectly calculates the required memory allocation. A remote attacker who supplies a crafted image for processing can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) through process crashes. Additionally, uninitialized memory gaps can result in information disclosure by leaking remnants of previously stored data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The attack complexity is high and also for services that do hit this code path (image upload \u2192 TIFF re-encode to BytesIO \u2192 return/upload), the minimal PoC reliably crashes the worker process. The heap corruption could plausibly be developed into RCE by a skilled attacker who has already compromised the same process enough to leak addresses, but that\u0027s a chained-exploit scenario, not a standalone wormable RCE.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112393"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555846",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555846"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112393",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112393"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112393",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112393"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/11582e5ffbdceb973d5ee593f3105af5a9852b40",
          "url": "https://github.com/python-pillow/Pillow/commit/11582e5ffbdceb973d5ee593f3105af5a9852b40"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf"
        }
      ],
      "release_date": "2026-10-19T20:46:40.784000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO"
    },
    {
      "cve": "CVE-2026-112397",
      "cwe": {
        "id": "CWE-124",
        "name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
      },
      "discovery_date": "2026-10-19T21:22:05.164607+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555868"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. A remote attacker can cause a Denial of Service (DoS) by supplying a specially crafted image with a width of zero to an application performing morphology operations. Because Pillow fails to validate zero-width image geometry during these operations, it attempts an out-of-bounds memory access before the buffer boundary, resulting in an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having Important impact because remote, unauthenticated attackers can trigger an immediate denial of service by crashing target processes without requiring user intervention. In typical Red Hat product deployments, exposure is limited because triggering the flaw requires an application to actively process untrusted image input through morphological transformations. Workloads that parse standard image formats without performing morphology operations are not susceptible to this failure mode.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112397"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555868",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555868"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112397",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112397"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112397",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112397"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/18f7c0dfee93063c51db6ed0ca8c4da2999dcb64",
          "url": "https://github.com/python-pillow/Pillow/commit/18f7c0dfee93063c51db6ed0ca8c4da2999dcb64"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-58r4-6rv3-gfh8",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-58r4-6rv3-gfh8"
        }
      ],
      "release_date": "2026-10-19T21:17:35.684000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to validate image dimensions to reject zero-width or zero-height inputs before invoking ImageMorph.MorphOp.apply() in Python Pillow: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which check for zero width or height and return early before executing morphology row manipulations in src/_imagingmorph.c, closing all 2 injection vectors (crafted zero-width PPM image, crafted zero-width PGM image). Until patched, this is a concern on Applications processing untrusted images using Pillow\u0027s ImageMorph.MorphOp.apply(), so Reject incoming image files with zero width or zero height, particularly PPM and PGM formats, before submitting them to morphology routines. These controls limit blast radius and contain exploitation, but they do not fix the underlying out-of-bounds memory access buffer underflow defect \u2014 apply the upstream patch to fully remediate.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images"
    },
    {
      "cve": "CVE-2026-112398",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-10-19T21:21:59.767228+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555867"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. A remote attacker can achieve arbitrary code execution by supplying a specially crafted FlashPix (FPX) image file to an application that processes untrusted inputs. Due to improper handling of image tile data during JPEG decoding, the library writes pixel data beyond the allocated memory buffer. This out-of-bounds write corrupts heap memory and can allow an attacker to execute arbitrary commands or cause an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "- Requires optional olefile package installed (not bundled by default in RHEL/most containers)\n- High attack complexity for reliable RCE (heap layout control, vtable hijacking)\n- Affects a file format (FlashPix) rarely used in production image processing",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112398"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555867",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555867"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112398",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112398"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112398",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112398"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75",
          "url": "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52h",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52h"
        }
      ],
      "release_date": "2026-10-19T21:07:25.229000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution"
    },
    {
      "cve": "CVE-2026-112399",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-19T21:21:30.155551+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555863"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. A remote attacker can trigger a Denial of Service (DoS) by providing a specially crafted Animated Portable Network Graphics (APNG) image. Pillow allocates memory for the full canvas dimensions before validating safety size limits during initial file opening. Processing such an image can exhaust available system memory and cause the application to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: pillow: Denial of service via crafted APNG image",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity for Red Hat products because an unauthenticated remote attacker can cause a denial of service through memory exhaustion without requiring user interaction or elevated privileges. Red Hat solutions such as OpenShift AI and Ansible Automation Platform integrate Pillow to process arbitrary user or automated media uploads. Because full-canvas memory allocation occurs during initial file header ingestion prior to decompression safety limits being enforced, applications cannot rely on standard dimension safeguards to prevent worker termination.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112399"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555863",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555863"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112399",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112399"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112399",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112399"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48",
          "url": "https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9"
        }
      ],
      "release_date": "2026-10-19T21:10:11.266000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce decompression bomb validation checks prior to full-canvas memory allocation during initial image parsing in Pillow: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which call Image._decompression_bomb_check(self.size) immediately after opening each frame to raise DecompressionBombError before allocating frame buffers, closing all 2 injection vectors (crafted APNG image with OP_BACKGROUND disposal, crafted APNG image with first-frame OP_PREVIOUS disposal). Until patched, this is a concern on Applications on any platform opening untrusted image files with Pillow Image.open, so Restrict ingestion of untrusted APNG files and validate image header metadata before passing input to Image.open. As a compensating measure, Monitor memory pressure events and PSI metrics to detect abnormal allocation spikes from oversized canvas sizing, Enforce process address space limits using ulimit or prlimit RLIMIT_AS to restrict maximum memory consumption during parsing, Configure systemd service watchdogs and automatic restarts to restore availability if process termination occurs, and Apply cgroups v2 memory constraints to isolate container or service memory exhaustion and protect host availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying uncontrolled memory allocation defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: pillow: Denial of service via crafted APNG image"
    },
    {
      "cve": "CVE-2026-112400",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-19T21:21:41.148327+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555864"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. When parsing a crafted GIF image, the library fails to discard rejected frame dimensions after encountering an excessively large image exception. If an application catches this exception and continues processing the image, subsequent operations attempt to allocate memory based on the oversized dimensions. A remote attacker can exploit this issue to exhaust system memory, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as Important because an unauthenticated remote attacker can supply a malicious graphic file that forces extensive memory allocations, leading to daemon termination or denial of service. The flaw requires consuming applications to catch decompression bomb exceptions and reuse the same image object across subsequent frame operations, allowing oversized geometry values to trigger high resource exhaustion. Exposure is largely concentrated in containerized services and image-processing pipelines that handle untrusted animation uploads directly.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112400"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555864",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555864"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112400",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112400"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112400",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112400"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/6faed707cfb760a4cbd726ddc8406f576cf35bf7",
          "url": "https://github.com/python-pillow/Pillow/commit/6faed707cfb760a4cbd726ddc8406f576cf35bf7"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg"
        }
      ],
      "release_date": "2026-10-19T21:12:37.401000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to discard image objects immediately upon catching DecompressionBombError rather than continuing seek or load operations: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which validate computed frame dimensions with _decompression_bomb_check before updating self._size, closing crafted GIF image with oversized frame extents. Until patched, this is a concern on applications parsing untrusted GIF images that catch DecompressionBombError exceptions and continue operating on the same image object, so avoid catching DecompressionBombError to reuse the same image instance, and ensure failed image processing operations immediately destroy or discard the affected object. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI to detect anomalous memory spikes and pending OOM events, restrict process virtual address space using ulimit or prlimit (RLIMIT_AS) to bound oversized allocations, and enforce cgroups v2 memory resource limits on containers or process groups to prevent host-wide memory exhaustion. These controls limit blast radius and contain exploitation, but they do not fix the underlying retained image dimension defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image"
    },
    {
      "cve": "CVE-2026-112402",
      "cwe": {
        "id": "CWE-1341",
        "name": "Multiple Releases of Same Resource or Handle"
      },
      "discovery_date": "2026-10-19T21:21:01.037991+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555859"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. A remote attacker who can submit large image transformation operations under memory pressure can trigger improper error handling, leading to a double-free vulnerability (releasing the same memory block twice). This issue can result in an application crash, causing a Denial of Service (DoS), and may potentially lead to memory corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: pillow: Denial of service via double free during image transformation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because remote, unauthenticated attackers can cause service disruptions or memory corruption in applications that accept user-controlled image transformation requests without requiring prior privileges. In typical Red Hat environments, such as containerized AI or automation workloads processing image data, processing oversized transformation geometries under strict process memory limits forces premature deallocation of internal structures, culminating in process termination. Applications that sanitize image bounds or avoid exposing custom affine transform endpoints remain largely unaffected by this crash condition.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112402"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555859",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555859"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112402",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112402"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112402",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112402"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9",
          "url": "https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm"
        }
      ],
      "release_date": "2026-10-19T21:18:57.027000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to eliminate premature destination image deletion in the ImagingScaleAffine error handling path so that the caller retains exclusive ownership of image memory cleanup: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which remove the ImagingDelete(imOut) call from the allocation error path in ImagingScaleAffine() and rely on the caller to free the destination image when the transform fails, closing all 2 injection vectors (crafted Image.transform() operations using Transform.EXTENT, crafted Image.transform() operations using Transform.AFFINE). Until patched, this is a concern on Applications executing Pillow Image.transform() operations with untrusted dimensions under memory pressure, so Validate and constrain requested dimensions in Image.transform() calls, avoid using Transform.EXTENT or scale-and-translate Transform.AFFINE with NEAREST resampling on untrusted input, and ensure sufficient memory limits to prevent selective allocation failures. As a compensating measure, Deploy EDR agents to detect abnormal process terminations and memory corruption exploitation attempts resulting from the double-free condition. These controls limit blast radius and contain exploitation, but they do not fix the underlying double-free error handling defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1001 EDR Agent (Endpoint Detection \u0026 Response) (medium)",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: pillow: Denial of service via double free during image transformation"
    },
    {
      "cve": "CVE-2026-112403",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-10-19T21:41:54.085786+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555871"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. A remote attacker could exploit this vulnerability to achieve arbitrary code execution or cause a Denial of Service (DoS) by supplying a specially crafted lossless JPEG image to an application that downscales images or generates thumbnails. This issue occurs because the JPEG decoder fails to verify actual output dimensions against the allocated memory buffer during scaling, causing full-width image data to be written beyond buffer boundaries. Successful exploitation leads to heap memory corruption, resulting in an application crash or potential code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: Pillow: Heap buffer overflow in ImagingJpegDecode",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The overflow only triggers when the application calls `draft()` or `thumbnail()` before loading the image. Direct `Image.open().load()` or `Image.open().resize()` decode at scale 1 and are unaffected. Many image processing pipelines use `load()` followed by `resize()`, not `thumbnail()`. The libjpeg-turbo 3.x requirement, specific code path, and dimension threshold make this **not easily exploitable** across the entire Pillow install base.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112403"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555871",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555871"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112403",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112403"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112403",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112403"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75",
          "url": "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8g5g-8vmr-9782",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8g5g-8vmr-9782"
        }
      ],
      "release_date": "2026-10-19T21:22:21.077000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: Pillow: Heap buffer overflow in ImagingJpegDecode"
    },
    {
      "cve": "CVE-2026-112404",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-10-19T21:43:45.124371+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555874"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. When processing Tagged Image File Format (TIFF) images, the library fails to properly validate buffer boundaries during tile and color decoding routines. A remote attacker could exploit this vulnerability by supplying a specially crafted TIFF file with conflicting metadata tags, causing an out-of-bounds read. Successful exploitation can lead to a Denial of Service (DoS) by crashing the application, or result in information disclosure by exposing adjacent heap memory in the output image.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can exploit it to terminate backend worker processes or leak adjacent heap contents without requiring elevated privileges. Red Hat products utilizing Pillow within containerized services, AI model serving, or automation workflows may be exposed if they accept and parse untrusted TIFF files. Because TIFF parsing occurs automatically during standard image opening routines without requiring custom decode flags, services that ingest user-provided media are susceptible to denial of service or memory exposure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112404"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555874",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555874"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112404",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112404"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112404",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112404"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce",
          "url": "https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-c6hw-5grf-ff96",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-c6hw-5grf-ff96"
        }
      ],
      "release_date": "2026-10-19T21:27:56.705000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to block untrusted TIFF ingestion or ensure row size validation between unpackers and libtiff buffers in Pillow decoding workflows: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which reject TIFF images where the unpacker row size exceeds libtiff\u0027s decoded row and zero unwritten buffer space in tile and strip decoders, closing all 2 injection vectors (crafted TIFF image file with duplicate PhotometricInterpretation tags, crafted TIFF image file with duplicate BitsPerSample tags). Until patched, this is a concern on applications and automated pipelines parsing untrusted TIFF images with Pillow, so restrict untrusted TIFF file processing and disable automated thumbnail or preview generation for untrusted TIFF inputs. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap out-of-bounds read defect \u2014 apply the upstream patch to fully remediate.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding"
    },
    {
      "cve": "CVE-2026-112405",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-10-19T21:42:15.131597+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555873"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. A remote attacker can cause a Denial of Service (DoS) by supplying a specially crafted image file to an application that processes images with the library. This issue occurs because the Image.merge() function fails to properly validate the first input band, allowing mismatched image storage formats to trigger a null pointer dereference. Consequently, processing the malformed image causes the native application process to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having an Important impact for Red Hat products because an unauthenticated remote attacker can crash service worker processes handling user uploads without requiring privileges or prior interaction. In Red Hat environments such as Ansible Automation Platform, Satellite, and OpenShift AI, Pillow is embedded across containerized services and platform tooling that handle image ingest and transformation. Because parsing an invalid image file triggers an immediate segmentation fault within the native extension, the issue causes service disruption, although it does not compromise data confidentiality or allow arbitrary code execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112405"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555873",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555873"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112405",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112405"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112405",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112405"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/b6ee66e8b2c2c0932bdf65f963268d9f2927ef86",
          "url": "https://github.com/python-pillow/Pillow/commit/b6ee66e8b2c2c0932bdf65f963268d9f2927ef86"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-cp9v-662q-vvx9",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-cp9v-662q-vvx9"
        }
      ],
      "release_date": "2026-10-19T21:29:53.515000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to validate all input image bands to reject 4-byte pixel sizes and 32-bit storage modes prior to invoking Image.merge(): upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which validate all input bands and reject any band with a 4-byte pixel size or non-single band configuration with a mode error, closing all 2 injection vectors (crafted IPTC image file parsed during standard open and load operations, direct invocation of Image.merge() with a 32-bit image band). Until patched, this is a concern on applications using Pillow to process untrusted image files or calling Image.merge() on untrusted image bands, so restrict image ingestion pipelines from processing untrusted IPTC files or passing unvalidated 32-bit single-band images into Image.merge(). As a compensating measure, enforce an explicit allowlist of permitted image modes and band configurations before invoking Image.merge() to prevent processing unsupported 32-bit image bands. These controls limit blast radius and contain exploitation, but they do not fix the underlying null pointer dereference defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (medium)",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()"
    },
    {
      "cve": "CVE-2026-112406",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-10-20T16:21:58.830847+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556322"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) through an infinite loop during PDF page processing. When rewriting pages, the parser fails to detect circular references in the page tree hierarchy. By submitting a specially crafted PDF document to an application that modifies or appends images to it, an attacker can exhaust system CPU resources and make the service unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: pillow: Denial of Service via infinite loop during PDF page rewriting",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because an unauthenticated remote user can supply a crafted document to trigger an infinite processing loop, resulting in complete CPU core exhaustion and denial of service for the target application worker. The issue specifically threatens services or workloads that ingest untrusted PDFs and append or save pages to them. Standard image parsing and reading pipelines that do not modify or append to existing PDF structures remain unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112406"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556322",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556322"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112406",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112406"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112406",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112406"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/b3ebf20c694f2f12537a629c30229a1d5a53f777",
          "url": "https://github.com/python-pillow/Pillow/commit/b3ebf20c694f2f12537a629c30229a1d5a53f777"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-f2g6-542v-9j58",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-f2g6-542v-9j58"
        }
      ],
      "release_date": "2026-10-19T21:31:49.946000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to halt page-tree traversal upon detecting repeated node references during PDF page rewriting in Pillow: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which track visited page-tree node references during deletion traversal and halt iteration if a reference repeats, closing crafted PDF with cyclic Parent references in page tree. Until patched, this is a concern on applications that modify or append images to supplied PDFs using Pillow, so restrict untrusted PDF submissions to applications that modify or append images, and apply execution timeouts on PDF handling workers. As a compensating measure, impose maximum CPU time limits on worker processes using RLIMIT_CPU via ulimit or prlimit to terminate execution when an infinite loop occurs, detect unresponsiveness in hung worker processes via systemd WatchdogSec heartbeats and automatically restart the service, and constrain maximum CPU quotas for the processing container or service using cgroups v2 to prevent host resource starvation. These controls limit blast radius and contain exploitation, but they do not fix the underlying infinite loop defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: pillow: Denial of Service via infinite loop during PDF page rewriting"
    },
    {
      "cve": "CVE-2026-112892",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-10-22T21:32:36.389983+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2559393"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. A remote attacker can cause a Denial of Service (DoS) by supplying a specially crafted Microsoft Paint (MSP) image file to an application that processes image pixels. Due to missing expansion limits during decompression, the run-length encoding (RLE) decoder expands image data into an unbounded memory buffer, resulting in memory exhaustion and application crashes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is evaluated as an Important impact because remote unauthenticated actors can induce an application denial of service by consuming all host or container memory, bypassing standard decompression safety limits. In Red Hat deployments such as Red Hat OpenShift AI and Red Hat Quay, service ingestion workflows accepting user-submitted graphics could suffer process termination or node instability when decoding untrusted assets. Deployments that process only verified internal content or do not expose image analysis to external inputs face substantially lower operational risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112892"
        },
        {
          "category": "external",
          "summary": "RHBZ#2559393",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559393"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112892",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112892"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112892",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112892"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/5dcb630b9798efd91929cb873d677aeee6ed0bb3",
          "url": "https://github.com/python-pillow/Pillow/commit/5dcb630b9798efd91929cb873d677aeee6ed0bb3"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-gg2r-wvfm-q9rx",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-gg2r-wvfm-q9rx"
        }
      ],
      "release_date": "2026-10-19T21:35:25.797000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder"
    },
    {
      "cve": "CVE-2026-112893",
      "cwe": {
        "id": "CWE-763",
        "name": "Release of Invalid Pointer or Reference"
      },
      "discovery_date": "2026-10-19T22:01:14.071566+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555878"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. When rendering text using FreeType with an active stroke width, a failure during glyph loading can cause the library to free an uninitialized or stale memory pointer. A remote attacker could exploit this vulnerability by supplying a malformed font to an application that renders stroked text. Successful exploitation can lead to memory corruption or an application crash, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: Pillow: Denial of Service via invalid pointer free during font rendering",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as having an Important severity because an unauthenticated remote attacker could cause memory corruption or terminate the application process without requiring privileges, leading to a denial of service. Across Red Hat product environments, Pillow operates as an underlying imaging component in automated services and containerized workloads. The vulnerability is only triggered if an application accepts untrusted font files from users and renders text using non-zero stroke widths, leaving services that utilize standard system fonts unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112893"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555878",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555878"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112893",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112893"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112893",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112893"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13",
          "url": "https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47"
        }
      ],
      "release_date": "2026-10-19T21:53:49.979000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to ensure glyph pointers are initialized to NULL and verified before invocation in FreeType stroked font rendering cleanup: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize the glyph pointer to NULL, reset it to NULL after freeing in the render loop, and check that glyph is not NULL before calling FT_Done_Glyph in cleanup, closing all 2 injection vectors (malformed font bytes supplied to FreeType rendering, crafted TrueType font triggering glyph loading failure). Until patched, this is a concern on applications accepting untrusted font data and rendering text using FreeType with a non-zero stroke width, so restrict applications from loading untrusted font files and avoid rendering FreeType text with a non-zero stroke width. These controls limit blast radius and contain exploitation, but they do not fix the underlying invalid pointer free defect \u2014 apply the upstream patch to fully remediate.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: Pillow: Denial of Service via invalid pointer free during font rendering"
    },
    {
      "cve": "CVE-2026-112894",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-19T22:01:05.404464+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555875"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. When converting multi-frame images into a multi-page PDF document, the library repeatedly scans previously assigned object identifiers, resulting in quadratic processing time. A remote attacker could exploit this vulnerability by supplying a crafted image with a large frame count, causing excessive CPU consumption and a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: pillow: Denial of Service via crafted multi-frame image conversion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can cause severe CPU exhaustion and service disruption by submitting minimal crafted inputs without needing system privileges. The elevated risk arises because even tiny files with declared high sequence numbers can tie up backend worker processes for prolonged periods in applications that convert user-provided graphics into multipage documents. Deployments remain unaffected if they only perform standard single-image rendering, validation, or do not expose multi-frame document export capabilities to untrusted users.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112894"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555875",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555875"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112894",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112894"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112894",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112894"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb",
          "url": "https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm"
        }
      ],
      "release_date": "2026-10-19T21:55:19.424000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to validate and enforce upper bounds on image frame counts before passing untrusted files to Pillow multi-page PDF conversion with save_all enabled: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which maintain a running maximum object ID attribute on XrefTable updated upon key insertion to resolve identifiers in constant time instead of scanning all keys with max(), closing all 2 injection vectors (crafted multi-frame image with a large number of frames, crafted small APNG image with an inflated declared frame count). Until patched, this is a concern on applications converting untrusted user-supplied multi-frame images to PDF documents using save_all=True across all platforms, so Restrict untrusted image uploads, enforce strict frame count validation before processing, or disable multi-page PDF conversion using save_all=True. As a compensating measure, Impose per-process CPU time limits using ulimit or prlimit (RLIMIT_CPU) to terminate runaway PDF conversion processes and bound CPU starvation, Configure service watchdog timers such as systemd WatchdogSec and Restart to restart processes that hang during quadratic object scanning, and Constrain cgroups v2 CPU quotas to restrict the blast radius of excessive CPU utilization during multi-frame PDF generation. These controls limit blast radius and contain exploitation, but they do not fix the underlying quadratic object identifier scanning defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: pillow: Denial of Service via crafted multi-frame image conversion"
    },
    {
      "cve": "CVE-2026-112895",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-10-19T22:01:20.951322+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555879"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted PDF document to an application performing PDF append operations. Because the PDF parser fails to properly track cyclic or deeply nested object references, processing the malicious document can consume excessive CPU and memory resources or trigger an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: pillow: Denial of service via crafted PDF during append operations",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can cause severe service disruption and denial of service without requiring elevated privileges. Red Hat products shipping Pillow\u2014including components within Red Hat OpenShift AI, Ansible Automation Platform, and Satellite\u2014are exposed only when configured to append images to untrusted, user-supplied PDF documents. Standard deployments that do not append to external PDF files or that generate new documents from trusted sources are unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112895"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555879",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555879"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112895",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112895"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112895",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112895"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/e2ae7eacad6de68c37eb28b633a97bebacf2c5bf",
          "url": "https://github.com/python-pillow/Pillow/commit/e2ae7eacad6de68c37eb28b633a97bebacf2c5bf"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-p4wg-p73j-c528",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-p4wg-p73j-c528"
        }
      ],
      "release_date": "2026-10-19T21:57:14.207000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to disable PDF append operations or prevent untrusted PDF inputs from reaching Pillow Image.save calls: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which replaces recursive page-tree traversal with an iterative stack of iterators and tracks visited object IDs in a set to reject duplicate or cyclic references, closing all 4 injection vectors (cyclic PDF page-tree child references, deeply nested PDF page trees, repeated non-cyclic /Kids references, long chains of unique PDF trailer offsets). Until patched, this is a concern on Applications accepting user-supplied PDF documents and invoking Image.save with PDF append enabled, so restrict user-supplied PDF uploads and audit application workflows to prevent untrusted files from being processed by Image.save with append=True. As a compensating measure, Enforce CPU and memory limits using ulimit or prlimit to cap resource consumption and contain host-level exhaustion, Deploy systemd service watchdogs with WatchdogSec and Restart directives to detect application hangs or process termination and restart services automatically, Enforce strict bounds on uploaded file size and structure complexity at the application boundary before passing data to Pillow\u0027s append parser, and Constrain process CPU and memory utilization using cgroups v2 to limit the blast radius of runaway loop traversal during PDF append operations. These controls limit blast radius and contain exploitation, but they do not fix the underlying uncontrolled recursion defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: pillow: Denial of service via crafted PDF during append operations"
    },
    {
      "cve": "CVE-2026-112896",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-10-19T22:21:29.226245+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555890"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. When saving or re-encoding a Tagged Image File Format (TIFF) image containing inconsistent color map metadata, the encoder reads beyond an allocated memory buffer. A remote attacker could exploit this vulnerability by submitting a specially crafted image, leading to a Denial of Service (DoS) via an application crash or information disclosure of heap memory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important severity for Red Hat products because remote, unauthenticated attackers can supply crafted image files over network endpoints to cause process termination or heap memory disclosure without requiring privileges. The impact primarily concerns applications and containerized services that ingest untrusted image data and subsequently re-encode or save it using the libtiff-backed encoder while retaining metadata. Environments and workflows that only read, validate, or display images without writing them back out to TIFF format are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112896"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555890",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555890"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112896",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112896"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112896",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112896"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/d03dc3c587a9b0bdc9e4304d70d59a635a87b742",
          "url": "https://github.com/python-pillow/Pillow/commit/d03dc3c587a9b0bdc9e4304d70d59a635a87b742"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p"
        }
      ],
      "release_date": "2026-10-19T21:59:17.743000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to validate ColorMap tag length against BitsPerSample before passing retained metadata to the libtiff encoder during TIFF saves: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which validate that the ColorMap tag length matches (1 \u003c\u003c BitsPerSample) * 3 and compute plane stride dynamically from bits_per_sample instead of hardcoding a 256 stride, closing crafted TIFF image with inconsistent BitsPerSample and ColorMap length metadata. Until patched, this is a concern on applications processing untrusted TIFF files that re-encode or save them using the libtiff encoder, so avoid re-encoding untrusted TIFF files or strip retained ColorMap metadata prior to saving images with libtiff. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap out-of-bounds read defect \u2014 apply the upstream patch to fully remediate.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder"
    },
    {
      "cve": "CVE-2026-112897",
      "cwe": {
        "id": "CWE-908",
        "name": "Use of Uninitialized Resource"
      },
      "discovery_date": "2026-10-19T22:21:12.210877+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555888"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow. This flaw can lead to information disclosure when handling compressed Tagged Image File Format (TIFF) images. During incomplete decoding of image data, uninitialized buffer memory is not cleared before being converted into pixel rows. A remote attacker can exploit this vulnerability by submitting a crafted TIFF image to an application that decodes and returns or re-encodes the image, allowing them to view stale contents from heap memory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as Important because an unauthenticated remote attacker can exploit default image parsing workflows to extract sensitive process memory without requiring privileges or triggering application crashes. In Red Hat environments such as Red Hat OpenShift AI and Ansible Automation Platform, backend services that ingest user-provided images and return rendered thumbnails, previews, or re-encoded files inadvertently disclose previously freed heap data from concurrent or prior operations. The vulnerability requires processing compressed TIFF files where the decoder handles truncated image streams, meaning services that reject this format or never expose generated image outputs are not impacted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112897"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555888",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555888"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112897",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112897"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112897",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112897"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce",
          "url": "https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-q45j-58j2-45rg",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-q45j-58j2-45rg"
        }
      ],
      "release_date": "2026-10-19T22:00:52.749000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to zero uninitialized heap buffer memory during Pillow TIFF strip and tile decoding before exposing pixel rows to callers: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which zero out newly expanded buffer memory beyond the decoded size with memset in _decodeTile and _decodeStrip, closing all 2 injection vectors (crafted JPEG-compressed TIFF data, crafted Group 4 fax compressed TIFF data). Until patched, this is a concern on Applications decoding user-supplied TIFF images with Pillow and returning, previewing, or re-encoding pixel data, so Restrict or block untrusted TIFF image submissions to applications that decode and return, preview, or re-encode pixel data. These controls limit blast radius and contain exploitation, but they do not fix the underlying uninitialized heap buffer defect \u2014 apply the upstream patch to fully remediate.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding"
    },
    {
      "cve": "CVE-2026-114145",
      "cwe": {
        "id": "CWE-73",
        "name": "External Control of File Name or Path"
      },
      "discovery_date": "2026-10-21T20:51:27.620111+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2558563"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GitPython. This vulnerability allows an attacker to achieve arbitrary code execution by supplying an untrusted submodule path. Because the library fails to properly validate destination paths before cloning repository data, an attacker can plant a malicious executable script into sensitive directories, such as the Git hooks folder. Subsequent Git operations then trigger the planted script, executing commands in the context of the running application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "GitPython: GitPython: arbitrary code execution via improper submodule path validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because successful exploitation permits arbitrary code execution within the context of the underlying service or container. Although execution of arbitrary commands represents a critical consequence, the rating reflects the high complexity and prerequisites required, specifically that an application must accept user-controlled submodule paths and operate where default Git hook templates are absent. In Red Hat environments, such as Ansible Automation Platform, OpenShift AI, and Red Hat Satellite, impact is limited to workloads configured to process repository structures from untrusted or unauthenticated sources.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
          "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
          "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
          "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
          "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-114145"
        },
        {
          "category": "external",
          "summary": "RHBZ#2558563",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558563"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-114145",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-114145"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114145",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114145"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/commit/97eadb888d2f99567e3113f4e455be4ca128f697",
          "url": "https://github.com/gitpython-developers/GitPython/commit/97eadb888d2f99567e3113f4e455be4ca128f697"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/pull/2264",
          "url": "https://github.com/gitpython-developers/GitPython/pull/2264"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1",
          "url": "https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-83vg-56qc-22m7",
          "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-83vg-56qc-22m7"
        }
      ],
      "release_date": "2026-10-21T20:35:06.548000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T21:37:34+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor detailed instructions on applying this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92861"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19-capsule:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19-capsule:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19-capsule:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.src",
            "9Base-satellite-6.19:openvox-agent-0:8.31.1-1.el9sat.x86_64",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.noarch",
            "9Base-satellite-6.19:openvox-server-0:8.17.0-1.el9sat.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-brotli-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debuginfo-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-brotli-debugsource-0:1.2.1-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-django-0:4.2.30-3.el9pc.src",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-gitpython-0:3.2.1-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-pillow-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pillow-debugsource-0:13.0.0-1.el9pc.x86_64",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-pulp-ansible-1:0.28.10-1.el9pc.src",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.noarch",
            "9Base-satellite-6.19:python3.12-urllib3-0:2.8.0-1.el9pc.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src",
            "9Base-satellite-6.19:yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "GitPython: GitPython: arbitrary code execution via improper submodule path validation"
    }
  ]
}