{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Web Terminal Operator 1.14.2 has been released.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:94074",
        "url": "https://access.redhat.com/errata/RHSA-2026:94074"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-45336",
        "url": "https://access.redhat.com/security/cve/CVE-2024-45336"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-22866",
        "url": "https://access.redhat.com/security/cve/CVE-2025-22866"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-47907",
        "url": "https://access.redhat.com/security/cve/CVE-2025-47907"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44740",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44740"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-71556",
        "url": "https://access.redhat.com/security/cve/CVE-2026-71556"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/WTO-486",
        "url": "https://redhat.atlassian.net/browse/WTO-486"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/WTO-490",
        "url": "https://redhat.atlassian.net/browse/WTO-490"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/WTO-494",
        "url": "https://redhat.atlassian.net/browse/WTO-494"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/WTO-496",
        "url": "https://redhat.atlassian.net/browse/WTO-496"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/WTO-500",
        "url": "https://redhat.atlassian.net/browse/WTO-500"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/WTO-515",
        "url": "https://redhat.atlassian.net/browse/WTO-515"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/WTO-552",
        "url": "https://redhat.atlassian.net/browse/WTO-552"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/WTO-591",
        "url": "https://redhat.atlassian.net/browse/WTO-591"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94074.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Web Terminal Operator 1.14.2 release.",
    "tracking": {
      "current_release_date": "2026-11-03T16:25:54+00:00",
      "generator": {
        "date": "2026-11-03T16:25:54+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:94074",
      "initial_release_date": "2026-11-02T20:48:44+00:00",
      "revision_history": [
        {
          "date": "2026-11-02T20:48:44+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-02T20:48:49+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-03T16:25:54+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Web Terminal 1.14",
                "product": {
                  "name": "Red Hat Web Terminal 1.14",
                  "product_id": "Red Hat Web Terminal 1.14",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:webterminal:1.14::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Web Terminal"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
                "product": {
                  "name": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
                  "product_id": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/web-terminal-exec-rhel9@sha256%3A638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93?arch=amd64\u0026repository_url=registry.redhat.io/web-terminal/web-terminal-exec-rhel9\u0026tag=1793128187"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
                "product": {
                  "name": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
                  "product_id": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/web-terminal-rhel9-operator@sha256%3A6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed?arch=amd64\u0026repository_url=registry.redhat.io/web-terminal/web-terminal-rhel9-operator\u0026tag=1793128223"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
                "product": {
                  "name": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
                  "product_id": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/web-terminal-operator-bundle@sha256%3Afddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f?arch=amd64\u0026repository_url=registry.redhat.io/web-terminal/web-terminal-operator-bundle\u0026tag=1793204182"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64",
                "product": {
                  "name": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64",
                  "product_id": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/web-terminal-tooling-rhel9@sha256%3A5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e?arch=amd64\u0026repository_url=registry.redhat.io/web-terminal/web-terminal-tooling-rhel9\u0026tag=1793128190"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64 as a component of Red Hat Web Terminal 1.14",
          "product_id": "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64"
        },
        "product_reference": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
        "relates_to_product_reference": "Red Hat Web Terminal 1.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64 as a component of Red Hat Web Terminal 1.14",
          "product_id": "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64"
        },
        "product_reference": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
        "relates_to_product_reference": "Red Hat Web Terminal 1.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64 as a component of Red Hat Web Terminal 1.14",
          "product_id": "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64"
        },
        "product_reference": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
        "relates_to_product_reference": "Red Hat Web Terminal 1.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64 as a component of Red Hat Web Terminal 1.14",
          "product_id": "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
        },
        "product_reference": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64",
        "relates_to_product_reference": "Red Hat Web Terminal 1.14"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-45336",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2025-01-23T12:57:38.123000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2341751"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to `a.com/` containing an Authorization header redirected to `b.com/` will not send that header to `b.com`. However, the sensitive headers would be restored if the client received a subsequent same-domain redirect. For example, a chain of redirects from `a.com/`, to `b.com/1`, and finally to `b.com/2` would incorrectly send the Authorization header to `b.com/2`.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact: Red Hat products that include the affected golang net/http client are affected by a credential-disclosure flaw in HTTP redirect handling. When a client request with a sensitive header such as Authorization is redirected from one domain to another and then to a same-domain URL, the client can incorrectly restore and send that header to the final destination, potentially exposing credentials and other sensitive information. The current Red Hat scope contains affected entries across Red Hat Enterprise Linux, OpenShift Container Platform, and other Red Hat products and components; some affect records have a current NOTAFFECTED resolution, indicating those specific product/version records are not affected, but the record provides no technical justification for why. For affected entries marked DELEGATED, a fix is being pursued by the responsible product teams. For entries marked DEFER, the record does not establish a product-specific reason for deferral; the residual risk is that applications using the affected net/http client can still disclose sensitive headers through this redirect sequence. Red Hat\u0027s CVSS is 5.9 Moderate (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), compared with CISA\u0027s 6.1 Moderate, reflecting Red Hat\u0027s higher attack-complexity and unchanged-scope assessment and confidentiality-only impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-45336"
        },
        {
          "category": "external",
          "summary": "RHBZ#2341751",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2341751"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-45336",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-45336"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45336",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45336"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/go/issues/70530",
          "url": "https://github.com/golang/go/issues/70530"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/sSaUhLA-2SI",
          "url": "https://groups.google.com/g/golang-announce/c/sSaUhLA-2SI"
        }
      ],
      "release_date": "2025-01-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T20:48:44+00:00",
          "details": "To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.19 or higher.",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94074"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect"
    },
    {
      "cve": "CVE-2025-22866",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2025-02-06T17:00:56.155646+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2344219"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Golang crypto/internal/nistec package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Considering how this function is used, this leakage is likely insufficient to recover the private key when P-256 is used in any well-known protocols.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact: Red Hat product builds using the Golang crypto/internal/nistec component on ppc64le are exposed to a timing side channel. A variable-time instruction in an internal assembly function leaks a small number of bits of secret scalars; given how the function is used, the leakage is likely insufficient to recover a private key when P-256 is used in well-known protocols. The current affects cover Red Hat Enterprise Linux, OpenShift Container Platform, and other Red Hat products, while entries resolved as Not a Bug, Obsolete, or delegated NOTAFFECTED are outside the actionable affected scope. For the DEFER entries, remediation is deferred because the leakage is not believed sufficient for private-key recovery in those protocols; the residual risk is limited scalar-bit leakage on ppc64le. For DELEGATED entries, the same Moderate impact is being handled by the relevant product teams, with a fix being pursued. Red Hat\u0027s CVSS is 5.3 Moderate with a network attack vector, compared with CISA\u0027s 4.0 Moderate local-vector assessment.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-22866"
        },
        {
          "category": "external",
          "summary": "RHBZ#2344219",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344219"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-22866",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-22866"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-22866",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22866"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/643735",
          "url": "https://go.dev/cl/643735"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/71383",
          "url": "https://go.dev/issue/71383"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k",
          "url": "https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-3447",
          "url": "https://pkg.go.dev/vuln/GO-2025-3447"
        }
      ],
      "release_date": "2025-02-06T16:54:10.252000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T20:48:44+00:00",
          "details": "To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.19 or higher.",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94074"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec"
    },
    {
      "cve": "CVE-2025-47907",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization"
      },
      "discovery_date": "2025-08-07T16:01:06.247481+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2387083"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in database/sql. Concurrent queries can produce unexpected results when a query is cancelled during a Scan method call on returned Rows, creating a race condition. This vulnerability allows an attacker who can initiate and cancel queries to trigger this condition, possibly leading to inconsistent data being returned to the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "database/sql: Postgres Scan Race Condition",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability marked as Moderate severity issues rather than Important. The os/exec LookPath flaw requires a misconfigured PATH to be exploitable, and the database/sql race condition primarily impacts applications that cancel queries while running multiple queries concurrently. Both can cause unexpected behavior, but the exploitation scope is limited and unlikely to result in direct compromise in most typical deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-47907"
        },
        {
          "category": "external",
          "summary": "RHBZ#2387083",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2387083"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-47907",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-47907"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-47907",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47907"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/693735",
          "url": "https://go.dev/cl/693735"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/74831",
          "url": "https://go.dev/issue/74831"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/x5MKroML2yM",
          "url": "https://groups.google.com/g/golang-announce/c/x5MKroML2yM"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-3849",
          "url": "https://pkg.go.dev/vuln/GO-2025-3849"
        }
      ],
      "release_date": "2025-08-07T15:25:30.704000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T20:48:44+00:00",
          "details": "To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.19 or higher.",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94074"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "database/sql: Postgres Scan Race Condition"
    },
    {
      "cve": "CVE-2026-44740",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-06-01T17:01:53.685793+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2483894"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation and missing safety mechanisms when processing untrusted repository data and filesystem structures, leading to panics, infinite loops, uncontrolled recursion, or excessive resource consumption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is rated as an Important severity issue. The `go-billy` library, a Go filesystem abstraction, is vulnerable to a denial of service when processing crafted or malformed input, such as untrusted repository data or filesystem structures. Insufficient validation and missing safety mechanisms can lead to panics, infinite loops, or excessive resource consumption, potentially impacting the availability of applications that rely on this library.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
        ],
        "known_not_affected": [
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44740"
        },
        {
          "category": "external",
          "summary": "RHBZ#2483894",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483894"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44740",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44740"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44740",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44740"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-billy/releases/tag/v5.9.0",
          "url": "https://github.com/go-git/go-billy/releases/tag/v5.9.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1",
          "url": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6",
          "url": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6"
        }
      ],
      "release_date": "2026-06-01T16:04:50.358000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T20:48:44+00:00",
          "details": "To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.19 or higher.",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94074"
        },
        {
          "category": "workaround",
          "details": "To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation"
    },
    {
      "cve": "CVE-2026-56852",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition"
      },
      "discovery_date": "2026-07-21T20:01:56.266823+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504233"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64"
        ],
        "known_not_affected": [
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504233",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/794100",
          "url": "https://go.dev/cl/794100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80142",
          "url": "https://go.dev/issue/80142"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5970",
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "release_date": "2026-07-21T19:18:59.951000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T20:48:44+00:00",
          "details": "To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.19 or higher.",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94074"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "cve": "CVE-2026-71556",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access"
      },
      "discovery_date": "2026-08-07T16:51:14.251077+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2512562"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink, which, when cloned and its worktree operations are used, can lead to reading from or writing to arbitrary files outside the intended working directory. This could result in information disclosure or arbitrary file modification.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "go-git is a pure-Go implementation of Git. During worktree operations (checkout, status, add), go-git resolves symbolic links without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause a consuming application to read from or write to files outside the intended working directory when that repository is cloned and its worktree operations are used. Exploitation requires the application to clone an attacker-controlled repository and then perform worktree operations against it; applications that only process trusted repositories are not exposed. Red Hat rates the impact of this flaw as Important.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
        ],
        "known_not_affected": [
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
          "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-71556"
        },
        {
          "category": "external",
          "summary": "RHBZ#2512562",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512562"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-71556",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-71556"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71556",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71556"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab",
          "url": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac",
          "url": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/releases/tag/v5.19.2",
          "url": "https://github.com/go-git/go-git/releases/tag/v5.19.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5",
          "url": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm",
          "url": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm"
        }
      ],
      "release_date": "2026-08-07T16:37:40.058000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T20:48:44+00:00",
          "details": "To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.19 or higher.",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94074"
        },
        {
          "category": "workaround",
          "details": "To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later).",
          "product_ids": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:638ea07a1f28df6e0cc91107a42c830df88d02e4b602560ba61565922de18d93_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:fddc16952af6b66623badf12821472b9bc0fd58380e293a9e015daa01ef8dd1f_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:6bcecf2574d7efdfb2e124f6ccf31d8b2e33a1d79c940d69c3e2d006b1e617ed_amd64",
            "Red Hat Web Terminal 1.14:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:5580468463a8f11fb2fecb7e95abae716e3e10c9cafbc0d591747c0f269bc74e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution"
    }
  ]
}