Vulnerability-Lookup

RHSA-2026:94612

Vulnerability from csaf_redhat - Published: 2026-11-03 16:04 - Updated: 2026-11-13 16:45

Summary

Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.2 Security Update

Severity

Important

Notes

Topic: Red Hat Edge Manager Version 1.2.2 Security Update

Details: Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused management of edge devices and applications. It supports image-mode RHEL and container workloads that run on Podman/Docker or Kubernetes. RHEM is now available as a standalone feature, providing greater flexibility for edge deployments. In addition to the standalone version, RHEM continues to be offered as a plugin for the following platforms: * Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge devices. * Red Hat Ansible Automation Platform (AAP): Integrates edge management with Ansible automation. This integration enables organizations to optimize the management and orchestration of their fleets of edge devices; whether its thousands of dispersed retail point-of-sale systems or industrial machinery on remote factory floors. Value for customers and partners: * This solution not only helps customers manage thousands of devices but helps scale operations. * To manage large-scale deployments, customers need to be able to integrate with their existing management systems, support remote configuration and over-the-air updates, and collect telemetry data for advanced analytics. * Red Hat Edge Manager offers a simple and security-focused lifecycle management, from onboarding to decommissioning of edge devices. This complete end-to-end solution empowers organizations to gain the most value from the fleets of devices that generate data, all from a centralized location.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-73501

A flaw was found in kin-openapi. This vulnerability allows a remote attacker to bypass authentication checks. Specifically, the system incorrectly handles missing authentication configurations, substituting them with a function that does not verify user credentials. This enables unauthorized access to protected resources that should require proper authentication, compromising the application's security.

9.1 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-306 - Missing Authentication for Critical Functionality

Affected products

Fixed 28 products

Product	Version	Remediation
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-73502

A flaw was found in kin-openapi. An unauthenticated remote attacker can trigger a null-pointer dereference in the `openapi3filter.ValidateRequest` function. This occurs when validating a request against a `content` parameter whose `application/json` media type has no schema. Successful exploitation leads to a denial of service, causing request validation to panic and potentially resulting in an aborted request or a full process crash.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 28 products, the same list as for CVE-2026-73501

Threats

Impact Moderate

CVE-2026-77354

A flaw was found in kin-openapi, a Go project for handling OpenAPI files. An unauthenticated client can exploit this vulnerability by sending a specially crafted query with a large index in a deepObject query parameter. This forces the application to allocate multi-gigabyte memory, leading to an Out-of-Memory (OOM) error or a restart loop, effectively causing a Denial of Service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input

Affected products

Fixed 28 products, the same list as for CVE-2026-73501

Threats

Impact Important

CVE-2026-84445

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer() can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a Denial of Service (DoS). In some deployments, this attack can be unauthenticated.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 24 products

Product	Version	Remediation
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64	—	Vendor Fix fix

Known not affected 4 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64		—
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64		—
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64		—
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64		—

Threats

Impact Important

CVE-2026-88031

A flaw was found in go.mongodb.org/mongo-driver for version < 1.17.10 and < 2.9.1. Improper handling of data query elements in the GridFS component can lead to a file identifier being misinterpreted as a query. An authenticated user can exploit this to delete all GridFS file chunks, making stored file content unreadable, resulting in a denial of service.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CWE-1287 - Improper Validation of Specified Type of Input

Affected products

Fixed 24 products, the same list as for CVE-2026-84445

Known not affected 4 products, the same list as for CVE-2026-84445

Threats

Impact Important

CVE-2026-92615

A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git's process-global client.Protocols map via gitclient.InstallProtocol("https", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant's repository configuration is written last wins for all in-flight git.Clone calls. This race condition can cause one tenant's TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant's git operations.

6.6 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N

CWE-413 - Improper Resource Locking

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64		—	Vendor Fix fix Workaround

Known not affected 26 products

Product	Version	Remediation
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64	—	Workaround

Threats

Impact Moderate

CVE-2026-102276

A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial of Service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64	—	Vendor Fix fix Workaround

Known not affected 24 products

Product	Version	Remediation
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64	—	Workaround
Unresolved product id: Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64	—	Workaround

Threats

Impact Important

CVE-2026-102278

A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the application to crash.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products, the same list as for CVE-2026-102276

Known not affected 24 products, the same list as for CVE-2026-102276

Threats

Impact Important

References

75 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:94612	self
https://access.redhat.com/security/cve/CVE-2026-102276	external
https://access.redhat.com/security/cve/CVE-2026-102278	external
https://access.redhat.com/security/cve/CVE-2026-73501	external
https://access.redhat.com/security/cve/CVE-2026-73502	external
https://access.redhat.com/security/cve/CVE-2026-77354	external
https://access.redhat.com/security/cve/CVE-2026-84445	external
https://access.redhat.com/security/cve/CVE-2026-88031	external
https://access.redhat.com/security/cve/CVE-2026-92615	external
https://access.redhat.com/security/updates/classi…	external
https://docs.redhat.com/en/documentation/red_hat_…	external
https://docs.redhat.com/en/documentation/red_hat_…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-73501	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515006	external
https://www.cve.org/CVERecord?id=CVE-2026-73501	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73501	external
https://github.com/getkin/kin-openapi/commit/f040…	external
https://github.com/getkin/kin-openapi/releases/ta…	external
https://github.com/getkin/kin-openapi/security/ad…	external
https://access.redhat.com/security/cve/CVE-2026-73502	self
https://bugzilla.redhat.com/show_bug.cgi?id=2518119	external
https://www.cve.org/CVERecord?id=CVE-2026-73502	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73502	external
https://github.com/getkin/kin-openapi/commit/68ac…	external
https://github.com/getkin/kin-openapi/security/ad…	external
https://access.redhat.com/security/cve/CVE-2026-77354	self
https://bugzilla.redhat.com/show_bug.cgi?id=2521204	external
https://www.cve.org/CVERecord?id=CVE-2026-77354	external
https://nvd.nist.gov/vuln/detail/CVE-2026-77354	external
https://github.com/getkin/kin-openapi/commit/1223…	external
https://github.com/getkin/kin-openapi/pull/923	external
https://github.com/getkin/kin-openapi/releases/ta…	external
https://github.com/getkin/kin-openapi/security/ad…	external
https://access.redhat.com/security/cve/CVE-2026-84445	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533175	external
https://www.cve.org/CVERecord?id=CVE-2026-84445	external
https://nvd.nist.gov/vuln/detail/CVE-2026-84445	external
https://github.com/grpc/grpc-go/commit/3822494d8e…	external
https://github.com/grpc/grpc-go/commit/8668b69c16…	external
https://github.com/grpc/grpc-go/commit/93e31b4854…	external
https://github.com/grpc/grpc-go/issues/9354	external
https://github.com/grpc/grpc-go/pull/9365	external
https://github.com/grpc/grpc-go/pull/9366	external
https://github.com/grpc/grpc-go/pull/9367	external
https://github.com/grpc/grpc-go/releases/tag/v1.82.2	external
https://github.com/grpc/grpc-go/releases/tag/v1.83.2	external
https://github.com/grpc/grpc-go/security/advisori…	external
https://access.redhat.com/security/cve/CVE-2026-88031	self
https://bugzilla.redhat.com/show_bug.cgi?id=2531587	external
https://www.cve.org/CVERecord?id=CVE-2026-88031	external
https://nvd.nist.gov/vuln/detail/CVE-2026-88031	external
https://jira.mongodb.org/browse/GODRIVER-4081	external
https://www.mongodb.com/community/forums/t/mongod…	external
https://access.redhat.com/security/cve/CVE-2026-92615	self
https://bugzilla.redhat.com/show_bug.cgi?id=2518323	external
https://www.cve.org/CVERecord?id=CVE-2026-92615	external
https://nvd.nist.gov/vuln/detail/CVE-2026-92615	external
https://access.redhat.com/security/cve/CVE-2026-102276	self
https://bugzilla.redhat.com/show_bug.cgi?id=2542707	external
https://www.cve.org/CVERecord?id=CVE-2026-102276	external
https://nvd.nist.gov/vuln/detail/CVE-2026-102276	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/s…	external
https://access.redhat.com/security/cve/CVE-2026-102278	self
https://bugzilla.redhat.com/show_bug.cgi?id=2542700	external
https://www.cve.org/CVERecord?id=CVE-2026-102278	external
https://nvd.nist.gov/vuln/detail/CVE-2026-102278	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/s…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Edge Manager Version 1.2.2 Security Update",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused\nmanagement of edge devices and applications. It supports image-mode RHEL and\ncontainer workloads that run on Podman/Docker or Kubernetes.\n\nRHEM is now available as a standalone feature, providing greater flexibility for\nedge deployments. In addition to the standalone version, RHEM continues to be\noffered as a plugin for the following platforms:\n\n* Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge\ndevices.\n* Red Hat Ansible Automation Platform (AAP): Integrates edge management with\nAnsible automation.\n\nThis integration enables organizations to optimize the management and\norchestration of their fleets of edge devices; whether its thousands of\ndispersed retail point-of-sale systems or industrial machinery on remote factory\nfloors.\n\nValue for customers and partners:\n\n* This solution not only helps customers manage thousands of devices but helps\nscale operations.\n* To manage large-scale deployments, customers need to be able to integrate with\ntheir existing management systems, support remote configuration and over-the-air\nupdates, and collect telemetry data for advanced analytics.\n* Red Hat Edge Manager offers a simple and security-focused lifecycle\nmanagement, from onboarding to decommissioning of edge devices.\n\nThis complete end-to-end solution empowers organizations to gain the most value\nfrom the fleets of devices that generate data, all from a centralized location.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:94612",
        "url": "https://access.redhat.com/errata/RHSA-2026:94612"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-102276",
        "url": "https://access.redhat.com/security/cve/CVE-2026-102276"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-102278",
        "url": "https://access.redhat.com/security/cve/CVE-2026-102278"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73501",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73501"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73502",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73502"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-77354",
        "url": "https://access.redhat.com/security/cve/CVE-2026-77354"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84445",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84445"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-88031",
        "url": "https://access.redhat.com/security/cve/CVE-2026-88031"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-92615",
        "url": "https://access.redhat.com/security/cve/CVE-2026-92615"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.15/html-single/edge_manager/index#edge-mgr-intro",
        "url": "https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.15/html-single/edge_manager/index#edge-mgr-intro"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/managing_device_fleets_with_the_red_hat_edge_manager/assembly-edge-manager-intro",
        "url": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/managing_device_fleets_with_the_red_hat_edge_manager/assembly-edge-manager-intro"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94612.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.2 Security Update",
    "tracking": {
      "current_release_date": "2026-11-13T16:45:16+00:00",
      "generator": {
        "date": "2026-11-13T16:45:16+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.6"
        }
      },
      "id": "RHSA-2026:94612",
      "initial_release_date": "2026-11-03T16:04:22+00:00",
      "revision_history": [
        {
          "date": "2026-11-03T16:04:22+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-03T16:04:29+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-13T16:45:16+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Edge Manager 1.2",
                "product": {
                  "name": "Red Hat Edge Manager 1.2",
                  "product_id": "Red Hat Edge Manager 1.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:edge_manager:1.2::el10"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Edge Manager"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
                  "product_id": "registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-alert-exporter-rhel10@sha256%3A087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad?arch=amd64\u0026repository_url=registry.redhat.io/rhem/flightctl-alert-exporter-rhel10\u0026tag=1793719935"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
                  "product_id": "registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-alertmanager-proxy-rhel10@sha256%3Ae3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d?arch=amd64\u0026repository_url=registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10\u0026tag=1793719069"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
                  "product_id": "registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-api-rhel10@sha256%3A8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a?arch=amd64\u0026repository_url=registry.redhat.io/rhem/flightctl-api-rhel10\u0026tag=1793719962"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
                  "product_id": "registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-cli-artifacts-rhel10@sha256%3A0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3?arch=amd64\u0026repository_url=registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10\u0026tag=1793718690"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
                  "product_id": "registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-db-setup-rhel10@sha256%3A1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206?arch=amd64\u0026repository_url=registry.redhat.io/rhem/flightctl-db-setup-rhel10\u0026tag=1793719178"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
                  "product_id": "registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-imagebuilder-api-rhel10@sha256%3A0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09?arch=amd64\u0026repository_url=registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10\u0026tag=1793719991"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
                  "product_id": "registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-imagebuilder-worker-rhel10@sha256%3A63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5?arch=amd64\u0026repository_url=registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10\u0026tag=1793718758"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
                  "product_id": "registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-pam-issuer-rhel10@sha256%3Ad726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0?arch=amd64\u0026repository_url=registry.redhat.io/rhem/flightctl-pam-issuer-rhel10\u0026tag=1793718727"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
                  "product_id": "registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-periodic-rhel10@sha256%3A539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7?arch=amd64\u0026repository_url=registry.redhat.io/rhem/flightctl-periodic-rhel10\u0026tag=1793718794"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
                  "product_id": "registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-telemetry-gateway-rhel10@sha256%3Aae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30?arch=amd64\u0026repository_url=registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10\u0026tag=1793718813"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
                  "product_id": "registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-ui-ocp-rhel10@sha256%3A634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c?arch=amd64\u0026repository_url=registry.redhat.io/rhem/flightctl-ui-ocp-rhel10\u0026tag=1793719672"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
                  "product_id": "registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-ui-rhel10@sha256%3A50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c?arch=amd64\u0026repository_url=registry.redhat.io/rhem/flightctl-ui-rhel10\u0026tag=1793720014"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
                  "product_id": "registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-userinfo-proxy-rhel10@sha256%3A35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1?arch=amd64\u0026repository_url=registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10\u0026tag=1793720026"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64",
                  "product_id": "registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-worker-rhel10@sha256%3A4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75?arch=amd64\u0026repository_url=registry.redhat.io/rhem/flightctl-worker-rhel10\u0026tag=1793718463"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
                  "product_id": "registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-alert-exporter-rhel10@sha256%3A777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6?arch=arm64\u0026repository_url=registry.redhat.io/rhem/flightctl-alert-exporter-rhel10\u0026tag=1793719935"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
                  "product_id": "registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-alertmanager-proxy-rhel10@sha256%3A7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4?arch=arm64\u0026repository_url=registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10\u0026tag=1793719069"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
                  "product_id": "registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-api-rhel10@sha256%3A37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e?arch=arm64\u0026repository_url=registry.redhat.io/rhem/flightctl-api-rhel10\u0026tag=1793719962"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
                  "product_id": "registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-cli-artifacts-rhel10@sha256%3Ae1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e?arch=arm64\u0026repository_url=registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10\u0026tag=1793718690"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
                  "product_id": "registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-db-setup-rhel10@sha256%3Ad8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25?arch=arm64\u0026repository_url=registry.redhat.io/rhem/flightctl-db-setup-rhel10\u0026tag=1793719178"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
                  "product_id": "registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-imagebuilder-api-rhel10@sha256%3A5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6?arch=arm64\u0026repository_url=registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10\u0026tag=1793719991"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
                  "product_id": "registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-imagebuilder-worker-rhel10@sha256%3Ac3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e?arch=arm64\u0026repository_url=registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10\u0026tag=1793718758"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
                  "product_id": "registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-pam-issuer-rhel10@sha256%3A268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5?arch=arm64\u0026repository_url=registry.redhat.io/rhem/flightctl-pam-issuer-rhel10\u0026tag=1793718727"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
                  "product_id": "registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-periodic-rhel10@sha256%3Aed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2?arch=arm64\u0026repository_url=registry.redhat.io/rhem/flightctl-periodic-rhel10\u0026tag=1793718794"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
                  "product_id": "registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-telemetry-gateway-rhel10@sha256%3A5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f?arch=arm64\u0026repository_url=registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10\u0026tag=1793718813"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
                  "product_id": "registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-ui-ocp-rhel10@sha256%3Ac3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b?arch=arm64\u0026repository_url=registry.redhat.io/rhem/flightctl-ui-ocp-rhel10\u0026tag=1793719672"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
                  "product_id": "registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-ui-rhel10@sha256%3A318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed?arch=arm64\u0026repository_url=registry.redhat.io/rhem/flightctl-ui-rhel10\u0026tag=1793720014"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
                  "product_id": "registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-userinfo-proxy-rhel10@sha256%3A977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818?arch=arm64\u0026repository_url=registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10\u0026tag=1793720026"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
                "product": {
                  "name": "registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
                  "product_id": "registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/flightctl-worker-rhel10@sha256%3A23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652?arch=arm64\u0026repository_url=registry.redhat.io/rhem/flightctl-worker-rhel10\u0026tag=1793718463"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64 as a component of Red Hat Edge Manager 1.2",
          "product_id": "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
        },
        "product_reference": "registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64",
        "relates_to_product_reference": "Red Hat Edge Manager 1.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-73501",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Functionality"
      },
      "discovery_date": "2026-08-12T21:41:02.246848+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515006"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in kin-openapi. This vulnerability allows a remote attacker to bypass authentication checks. Specifically, the system incorrectly handles missing authentication configurations, substituting them with a function that does not verify user credentials. This enables unauthorized access to protected resources that should require proper authentication, compromising the application\u0027s security.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/getkin/kin-openapi: kin-openapi: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this as Important rather than Critical because exploitation requires the target application to explicitly instantiate and load the ValidationHandler middleware instead of ValidateRequest() or the Validator middleware.  \n\nRHOAI images ship kin-openapi 0.131\u20130.133 but do not invoke ValidationHandler as auth middleware in default roles (KServe, model-registry, mod-arch verified; BFF has no package). Hence, RHOAI is not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73501"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515006",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515006"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73501"
        },
        {
          "category": "external",
          "summary": "https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da",
          "url": "https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da"
        },
        {
          "category": "external",
          "summary": "https://github.com/getkin/kin-openapi/releases/tag/v0.144.0",
          "url": "https://github.com/getkin/kin-openapi/releases/tag/v0.144.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw",
          "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw"
        }
      ],
      "release_date": "2026-08-12T21:23:40.623000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-03T16:04:22+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94612"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/getkin/kin-openapi: kin-openapi: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default"
    },
    {
      "cve": "CVE-2026-73502",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-08-18T18:02:00.185346+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2518119"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in kin-openapi. An unauthenticated remote attacker can trigger a null-pointer dereference in the `openapi3filter.ValidateRequest` function. This occurs when validating a request against a `content` parameter whose `application/json` media type has no schema. Successful exploitation leads to a denial of service, causing request validation to panic and potentially resulting in an aborted request or a full process crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unauthenticated nil-pointer dereference",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this flaw as Moderate severity because in Go services built on the standard net/http server \u2014 which includes all affected Red Hat products \u2014 panics inside HTTP handlers are recovered automatically per-goroutine. Only the individual request fails; the service continues to serve subsequent requests without data loss or state corruption.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73502"
        },
        {
          "category": "external",
          "summary": "RHBZ#2518119",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2518119"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73502",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73502"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73502",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73502"
        },
        {
          "category": "external",
          "summary": "https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64",
          "url": "https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64"
        },
        {
          "category": "external",
          "summary": "https://github.com/getkin/kin-openapi/releases/tag/v0.144.0",
          "url": "https://github.com/getkin/kin-openapi/releases/tag/v0.144.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq",
          "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq"
        }
      ],
      "release_date": "2026-08-18T17:58:21.320000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-03T16:04:22+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94612"
        },
        {
          "category": "workaround",
          "details": "As a partial workaround, administrators can audit their OpenAPI specification files and ensure every content parameter declares an explicit schema for each media type, which prevents the nil-dereference code path from being reached.",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unauthenticated nil-pointer dereference"
    },
    {
      "cve": "CVE-2026-77354",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "discovery_date": "2026-08-21T21:01:36.238326+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2521204"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in kin-openapi, a Go project for handling OpenAPI files. An unauthenticated client can exploit this vulnerability by sending a specially crafted query with a large index in a deepObject query parameter. This forces the application to allocate multi-gigabyte memory, leading to an Out-of-Memory (OOM) error or a restart loop, effectively causing a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via uncontrolled resource consumption in deepObject query parameter decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this flaw as Important because a small request can exhaust memory and terminate an exposed service. Exploitation requires an application to decode attacker-controlled query parameters using kin-openapi\u2019s deepObject handling with an array-containing schema. Schema limits such as maxItems do not prevent the allocation, and HTTP handler panic recovery does not protect against process termination from memory exhaustion.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77354"
        },
        {
          "category": "external",
          "summary": "RHBZ#2521204",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521204"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77354",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77354"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77354",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77354"
        },
        {
          "category": "external",
          "summary": "https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388",
          "url": "https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388"
        },
        {
          "category": "external",
          "summary": "https://github.com/getkin/kin-openapi/pull/923",
          "url": "https://github.com/getkin/kin-openapi/pull/923"
        },
        {
          "category": "external",
          "summary": "https://github.com/getkin/kin-openapi/releases/tag/v0.142.0",
          "url": "https://github.com/getkin/kin-openapi/releases/tag/v0.142.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34",
          "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34"
        }
      ],
      "release_date": "2026-08-21T20:44:47.792000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-03T16:04:22+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94612"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via uncontrolled resource consumption in deepObject query parameter decoding"
    },
    {
      "cve": "CVE-2026-84445",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-09-14T16:22:17.356407+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533175"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer() can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a Denial of Service (DoS). In some deployments, this attack can be unauthenticated.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity impact because an unauthenticated remote client can crash the host daemon, causing an immediate denial of service across exposed endpoints. The issue specifically threatens deployments utilizing xDS-managed gRPC servers, as requests that omit standard routing authority parameters cause the application to crash on an unhandled slice lookup. Standard gRPC server implementations that do not configure xDS control plane routing are not susceptible to this failure mode. Furthermore, in environments enforcing mutual transport layer security (mTLS), successful transport authentication is required before reaching the vulnerable routing stage, restricting potential exploitation to authenticated peers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
        ],
        "known_not_affected": [
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533175",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533175"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84445",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84445",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7",
          "url": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4",
          "url": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f",
          "url": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/issues/9354",
          "url": "https://github.com/grpc/grpc-go/issues/9354"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/pull/9365",
          "url": "https://github.com/grpc/grpc-go/pull/9365"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/pull/9366",
          "url": "https://github.com/grpc/grpc-go/pull/9366"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/pull/9367",
          "url": "https://github.com/grpc/grpc-go/pull/9367"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2",
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2",
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj",
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"
        }
      ],
      "release_date": "2026-09-14T16:11:41.401000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-03T16:04:22+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94612"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests"
    },
    {
      "cve": "CVE-2026-88031",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-09-10T18:11:27.321656+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531587"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in go.mongodb.org/mongo-driver for version \u003c 1.17.10 and \u003c 2.9.1. \nImproper handling of data query elements in the GridFS component can lead to a file identifier being misinterpreted as a query. An authenticated user can exploit this to delete all GridFS file chunks, making stored file content unreadable, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the MongoDB Go Driver. The GridFS component does not properly sanitize caller-supplied file identifiers before using them in database queries. A structured document passed as a file ID (for example, a BSON document containing query operators) is interpreted as a query condition rather than a literal match value. An authenticated attacker who can influence the file identifier passed to GridFS operations such as Delete, DownloadToStream, or OpenDownloadStream in an affected application can exploit this to delete all chunks in a GridFS bucket, resulting in permanent data loss and denial of service.\nThe practical impact depends on whether the product\u0027s code passes externally-controlled values as GridFS file identifiers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
        ],
        "known_not_affected": [
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-88031"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531587",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531587"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-88031",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-88031"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88031",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88031"
        },
        {
          "category": "external",
          "summary": "https://jira.mongodb.org/browse/GODRIVER-4081",
          "url": "https://jira.mongodb.org/browse/GODRIVER-4081"
        },
        {
          "category": "external",
          "summary": "https://www.mongodb.com/community/forums/t/mongodb-go-driver-1-17-10-released/343342",
          "url": "https://www.mongodb.com/community/forums/t/mongodb-go-driver-1-17-10-released/343342"
        }
      ],
      "release_date": "2026-09-10T17:59:35.845000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-03T16:04:22+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94612"
        },
        {
          "category": "workaround",
          "details": "If upgrading go.mongodb.org/mongo-driver to version 1.17.10 (v1) or 2.9.1 (v2) is not immediately possible, the following steps can reduce exposure:\n- Validate file identifiers before passing them to GridFS operations. Ensure that file IDs supplied by users or external systems are scalar values (e.g., primitive.ObjectID or string) and reject any structured BSON documents or maps. This prevents query operator injection.\n- Restrict who can supply GridFS file identifiers. Do not allow unauthenticated or low-privilege users to directly control the file ID parameter in GridFS API calls (Delete, OpenDownloadStream, DownloadToStream, etc.).",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs"
    },
    {
      "cve": "CVE-2026-92615",
      "cwe": {
        "id": "CWE-413",
        "name": "Improper Resource Locking"
      },
      "discovery_date": "2026-07-01T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2518323"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git\u0027s process-global client.Protocols map via gitclient.InstallProtocol(\"https\", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant\u0027s repository configuration is written last wins for all in-flight git.Clone calls. \nThis race condition can cause one tenant\u0027s TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant\u0027s git operations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "flightctl: flightctl: Package-global go-git HTTPS transport mutated per-repo -- cross-tenant TLS-config bleed",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation requires a multi-tenant deployment where at least two organizations use git-backed configuration providers concurrently. The attacker must be a fleet administrator (able to create Repository resources with custom TLS settings), must control or operate an external git server to receive misdirected credentials, and must win a race condition with the victim\u0027s concurrent git clone. In single-organization deployments, the attacker already holds the same privileges as the victim, so the race provides no meaningful privilege escalation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
        ],
        "known_not_affected": [
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92615"
        },
        {
          "category": "external",
          "summary": "RHBZ#2518323",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2518323"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92615",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92615"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92615",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92615"
        }
      ],
      "release_date": "2026-09-16T14:34:11.570000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-03T16:04:22+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94612"
        },
        {
          "category": "workaround",
          "details": "There is no application-level workaround that fully eliminates this race condition without a code change. The following deployment-level measures reduce exposure in multi-tenant environments:\n- Avoid mTLS client certificates for git repositories: If tenant Repository resources do not supply client TLS certificates (httpConfig.tls.clientCertificate), the most sensitive data (client private key material) is absent from the global transport and cannot leak.\n- Avoid skipServerVerification: Do not set httpConfig.skipServerVerification: true on any Repository resource. This prevents a tenant\u0027s InsecureSkipVerify=true from propagating to other tenants\u0027 clones, which would otherwise allow an on-path attacker to serve malicious configuration.",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "flightctl: flightctl: Package-global go-git HTTPS transport mutated per-repo -- cross-tenant TLS-config bleed"
    },
    {
      "cve": "CVE-2026-102276",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-28T21:02:20.910434+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2542707"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this vulnerability as Important because an unauthenticated remote attacker can crash running Node.js services by submitting malformed pattern strings, resulting in a denial of service. In Red Hat environments, applications that accept arbitrary glob or expansion patterns from external inputs are susceptible to unexpected termination due to an unhandled call stack overflow. While this flaw allows service interruption without requiring privileges, it does not lead to code execution or compromise data confidentiality and integrity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64"
        ],
        "known_not_affected": [
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102276"
        },
        {
          "category": "external",
          "summary": "RHBZ#2542707",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542707"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102276",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102276"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102276",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102276"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
          "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
          "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
          "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
          "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"
        }
      ],
      "release_date": "2026-09-28T20:50:59.984000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-03T16:04:22+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94612"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns"
    },
    {
      "cve": "CVE-2026-102278",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-28T21:00:55.949756+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2542700"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the application to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because remote unauthenticated attackers can supply crafted nested expressions to trigger native stack exhaustion and crash server-side processes, resulting in a denial of service without compromising system confidentiality or integrity. In Red Hat environments, the affected library is distributed across containerized web consoles, developer tools, and Node.js runtime environments. Exploitation is constrained to deployments where applications process untrusted, user-defined pattern inputs directly through expansion functions without input depth validation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64"
        ],
        "known_not_affected": [
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
          "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102278"
        },
        {
          "category": "external",
          "summary": "RHBZ#2542700",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542700"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102278",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102278"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102278",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102278"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
          "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
          "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
          "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"
        }
      ],
      "release_date": "2026-09-28T20:57:09.850000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-03T16:04:22+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94612"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:087fc5f7104137321f01461359f1ae0a08c542f6e4c89793d18105e9c4cf45ad_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:777ac4942da38e934ae2eec871d06d103f7e1f9f136241db054185f00360c7b6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:7b7c232f7fbd6d0913a67f218880c4b774a2a723306c8dbca4a7ee0d175ac5c4_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10@sha256:e3e5e560321a1789f8e0a3efaed014e1d78bfe56cc9f39032c8240bf5c9ee39d_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:37ad1ff681bb3d4530298ca53c91e543df34312eef20c31857a3794bd6fb5e7e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-api-rhel10@sha256:8e787975a06cef54ea3b2b61a5f2419af06822c8085dc31704f925abd9b3224a_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:0231adf29782d4a67b2232ab220ee295a3ba64856abaa33f62a3a10354712fb3_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-cli-artifacts-rhel10@sha256:e1517d8bbd4ff6acd14dca25b416d063e4134715e69d45f1b487c2efc14a433e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:1c11442a28d89264f7e8ee9bb4180bee381161b06dfb74cf1fba4dacc10ab206_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-db-setup-rhel10@sha256:d8734168f48eed69fd893a8392634d78e1b12d43efb4dc366b5423ff1f4b8a25_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:0de36d8ea425a524b5d517b9be5d28806cf4c4d168528503aef78c7f0c675d09_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-api-rhel10@sha256:5f3c39597518a8a9cde3287b20cf69e7cb37d18e3e7a53163271a437aa0b7bf6_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:63567409df499efb450adedc450b81f5819a923e3e8da92486bf561c32296fc5_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-imagebuilder-worker-rhel10@sha256:c3034a98b0eed010c5d602c67d1a251dccebf4989c49f644a17ef1af9fff4e9e_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:268b388b569377f7066f07fe443a57ef86ac8775e13f1605979a7ab3e4b51ca5_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-pam-issuer-rhel10@sha256:d726c4e53103776d55eee9c9efc0cac185d75a168810bb960ad893769dcb72e0_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:539eea6f16f8c012781e360de343d6118e591f53ff0dc5145611aab502396ba7_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-periodic-rhel10@sha256:ed42afc50cfa89512a7b8a2bae49775f6d115e1cafbb19a6657ffc7a062eaee2_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:5dca38733a1ef9d0913c6ea6f1062d5470b65b43284a4611d13ed139adb69f2f_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-telemetry-gateway-rhel10@sha256:ae3fd0ca831fcf5132be9fa76bba95da42f1c2ffb590c400227b362b97b13c30_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:634a55e5a320fcb8f744e43dcc18e39d3a63771ea91ca4d8659f0966c774f09c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-ocp-rhel10@sha256:c3b2abc22a2c8c56d64ca93c16a3ec1df7e1c5f504e0e550230120d61e2b175b_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:318b70677f95f2a7dff219fe30d831adb5ec5bdeea4b5e5fe664d162a8d0e5ed_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-ui-rhel10@sha256:50b40f7012464fc2fedbd343db30f7fdaafbb382aa5beb33c475ff0e3489714c_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:35becda5154f3c24bc26cb89a6136a3ecd996e44d7008ca86bf22035d8dbb3e1_amd64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-userinfo-proxy-rhel10@sha256:977c02e894b4c9a0a1cc663520138a7e7513398f7e3da7af974e743723449818_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:23c2ab167e5c70797633054e5b4826ed09bd983fa396daffb5aee6db15a25652_arm64",
            "Red Hat Edge Manager 1.2:registry.redhat.io/rhem/flightctl-worker-rhel10@sha256:4f1df8a76cc0223011076fcfe64636c36e1f95ed026500373b5ca48a4d468b75_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns"
    }
  ]
}

CVE-2026-102276 (GCVE-0-2026-102276)

Vulnerability from cvelistv5 – Published: 2026-09-28 20:50 – Updated: 2026-09-29 13:38

Title

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

Summary

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 13:37 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-674 - Uncontrolled Recursion

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7868 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/juliangruber/brace-expansion/s…	x_refsource_CONFIRM
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
juliangruber	brace-expansion	Affected: >= 4.0.0, < 5.0.10 Affected: >= 3.0.0, < 3.0.7 Affected: >= 2.0.0, < 2.1.5 Affected: < 1.1.19

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102276",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T13:37:06.086529Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T13:38:29.919Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "brace-expansion",
          "vendor": "juliangruber",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 5.0.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.0.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.1.5"
            },
            {
              "status": "affected",
              "version": "\u003c 1.1.19"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T20:50:59.984Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"
        }
      ],
      "source": {
        "advisory": "GHSA-6j4f-fj2g-mc7p",
        "discovery": "UNKNOWN"
      },
      "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102276",
    "datePublished": "2026-09-28T20:50:59.984Z",
    "dateReserved": "2026-09-28T20:11:16.658Z",
    "dateUpdated": "2026-09-29T13:38:29.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102278 (GCVE-0-2026-102278)

Vulnerability from cvelistv5 – Published: 2026-09-28 20:57 – Updated: 2026-10-01 15:02

Title

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

Summary

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-01 15:02 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-674 - Uncontrolled Recursion

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7868 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/juliangruber/brace-expansion/s…	x_refsource_CONFIRM
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
juliangruber	brace-expansion	Affected: >= 4.0.0, < 5.0.11 Affected: >= 3.0.0, < 3.0.8 Affected: >= 2.0.0, < 2.1.6 Affected: < 1.1.20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102278",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T15:02:35.975978Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T15:02:44.798Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "brace-expansion",
          "vendor": "juliangruber",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 5.0.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.0.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.1.6"
            },
            {
              "status": "affected",
              "version": "\u003c 1.1.20"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T20:57:09.850Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"
        }
      ],
      "source": {
        "advisory": "GHSA-qhr7-859c-m2p7",
        "discovery": "UNKNOWN"
      },
      "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102278",
    "datePublished": "2026-09-28T20:57:09.850Z",
    "dateReserved": "2026-09-28T20:11:16.659Z",
    "dateUpdated": "2026-10-01T15:02:44.798Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73501 (GCVE-0-2026-73501)

Vulnerability from cvelistv5 – Published: 2026-08-12 21:23 – Updated: 2026-08-13 13:06

Title

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

Summary

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 13:06 UTC

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7868 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/getkin/kin-openapi/security/ad…	x_refsource_CONFIRM
https://github.com/getkin/kin-openapi/commit/f040…	x_refsource_MISC
https://github.com/getkin/kin-openapi/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getkin	kin-openapi	Affected: < 0.144.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73501",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T13:06:12.716245Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T13:06:36.863Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kin-openapi",
          "vendor": "getkin",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.144.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T21:23:40.623Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw"
        },
        {
          "name": "https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da"
        },
        {
          "name": "https://github.com/getkin/kin-openapi/releases/tag/v0.144.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getkin/kin-openapi/releases/tag/v0.144.0"
        }
      ],
      "source": {
        "advisory": "GHSA-r277-6w6q-xmqw",
        "discovery": "UNKNOWN"
      },
      "title": "kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73501",
    "datePublished": "2026-08-12T21:23:40.623Z",
    "dateReserved": "2026-08-12T19:00:33.736Z",
    "dateUpdated": "2026-08-13T13:06:36.863Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73502 (GCVE-0-2026-73502)

Vulnerability from cvelistv5 – Published: 2026-08-18 17:58 – Updated: 2026-08-18 18:42

Title

kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

Summary

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/req_resp_decoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 18:42 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7868 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/getkin/kin-openapi/security/ad…	x_refsource_CONFIRM
https://github.com/getkin/kin-openapi/commit/68ac…	x_refsource_MISC
https://github.com/getkin/kin-openapi/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getkin	kin-openapi	Affected: >= 0.2.0, < 0.144.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73502",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T18:42:00.680845Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T18:42:16.744Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kin-openapi",
          "vendor": "getkin",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.2.0, \u003c 0.144.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/req_resp_decoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T17:58:21.320Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq"
        },
        {
          "name": "https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64"
        },
        {
          "name": "https://github.com/getkin/kin-openapi/releases/tag/v0.144.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getkin/kin-openapi/releases/tag/v0.144.0"
        }
      ],
      "source": {
        "advisory": "GHSA-jpcw-4wr7-c3vq",
        "discovery": "UNKNOWN"
      },
      "title": "kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73502",
    "datePublished": "2026-08-18T17:58:21.320Z",
    "dateReserved": "2026-08-12T19:00:33.736Z",
    "dateUpdated": "2026-08-18T18:42:16.744Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77354 (GCVE-0-2026-77354)

Vulnerability from cvelistv5 – Published: 2026-08-21 20:44 – Updated: 2026-08-25 19:15

Title

kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

Summary

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the largest supplied index, after which buildResObj creates another slice of the same length. This allocation occurs before schema validation, so maxItems does not prevent it. An unauthenticated client can send a small query such as param[items][50000000]=x to an endpoint whose deepObject schema contains an array, forcing multi-gigabyte heap allocation and causing an OOM kill or restart loop. Other request-body encodings and styled parameters that do not produce bracketed integer indexes are not affected. This issue is fixed in version 0.142.0.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 19:15 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-789 - Memory Allocation with Excessive Size Value

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7868 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/getkin/kin-openapi/security/ad…	x_refsource_CONFIRM
https://github.com/getkin/kin-openapi/pull/923	x_refsource_MISC
https://github.com/getkin/kin-openapi/commit/1223…	x_refsource_MISC
https://github.com/getkin/kin-openapi/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getkin	kin-openapi	Affected: >= 0.124.0, < 0.142.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77354",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T19:15:10.388384Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T19:15:23.235Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kin-openapi",
          "vendor": "getkin",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.124.0, \u003c 0.142.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the largest supplied index, after which buildResObj creates another slice of the same length. This allocation occurs before schema validation, so maxItems does not prevent it. An unauthenticated client can send a small query such as param[items][50000000]=x to an endpoint whose deepObject schema contains an array, forcing multi-gigabyte heap allocation and causing an OOM kill or restart loop. Other request-body encodings and styled parameters that do not produce bracketed integer indexes are not affected. This issue is fixed in version 0.142.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T20:44:47.792Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34"
        },
        {
          "name": "https://github.com/getkin/kin-openapi/pull/923",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getkin/kin-openapi/pull/923"
        },
        {
          "name": "https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388"
        },
        {
          "name": "https://github.com/getkin/kin-openapi/releases/tag/v0.142.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getkin/kin-openapi/releases/tag/v0.142.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xhj3-7xw9-vr34",
        "discovery": "UNKNOWN"
      },
      "title": "kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77354",
    "datePublished": "2026-08-21T20:44:47.792Z",
    "dateReserved": "2026-08-20T19:28:35.244Z",
    "dateUpdated": "2026-08-25T19:15:23.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-84445 (GCVE-0-2026-84445)

Vulnerability from cvelistv5 – Published: 2026-09-14 16:11 – Updated: 2026-09-14 16:36

Title

gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers

Summary

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 16:36 UTC

CWE

CWE-129 - Improper Validation of Array Index
CWE-248 - Uncaught Exception

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7868 records in the last 180 days details

References

10 references

URL	Tags
https://github.com/grpc/grpc-go/security/advisori…	x_refsource_CONFIRM
https://github.com/grpc/grpc-go/issues/9354	x_refsource_MISC
https://github.com/grpc/grpc-go/pull/9365	x_refsource_MISC
https://github.com/grpc/grpc-go/pull/9366	x_refsource_MISC
https://github.com/grpc/grpc-go/pull/9367	x_refsource_MISC
https://github.com/grpc/grpc-go/commit/3822494d8e…	x_refsource_MISC
https://github.com/grpc/grpc-go/commit/8668b69c16…	x_refsource_MISC
https://github.com/grpc/grpc-go/commit/93e31b4854…	x_refsource_MISC
https://github.com/grpc/grpc-go/releases/tag/v1.82.2	x_refsource_MISC
https://github.com/grpc/grpc-go/releases/tag/v1.83.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
grpc	grpc-go	Affected: < 1.82.2 Affected: >= 1.83.0, < 1.83.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84445",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T16:36:00.554548Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T16:36:14.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grpc-go",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.82.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.83.0, \u003c 1.83.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-129",
              "description": "CWE-129: Improper Validation of Array Index",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T16:11:41.401Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"
        },
        {
          "name": "https://github.com/grpc/grpc-go/issues/9354",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/issues/9354"
        },
        {
          "name": "https://github.com/grpc/grpc-go/pull/9365",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/pull/9365"
        },
        {
          "name": "https://github.com/grpc/grpc-go/pull/9366",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/pull/9366"
        },
        {
          "name": "https://github.com/grpc/grpc-go/pull/9367",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/pull/9367"
        },
        {
          "name": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7"
        },
        {
          "name": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4"
        },
        {
          "name": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f"
        },
        {
          "name": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2"
        },
        {
          "name": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2"
        }
      ],
      "source": {
        "advisory": "GHSA-2v4p-qf9q-27wj",
        "discovery": "UNKNOWN"
      },
      "title": "gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-84445",
    "datePublished": "2026-09-14T16:11:41.401Z",
    "dateReserved": "2026-09-01T20:05:09.422Z",
    "dateUpdated": "2026-09-14T16:36:14.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-88031 (GCVE-0-2026-88031)

Vulnerability from cvelistv5 – Published: 2026-09-10 17:59 – Updated: 2026-09-10 18:25

Title

GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver

Summary

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

Severity

6.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 18:25 UTC

CWE

CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

Assigner

mongodb CNA under the mitre root

CNA scorecard C 70/100 over 261 records in the last 180 days details

References

1 reference

URL	Tags
https://jira.mongodb.org/browse/GODRIVER-4081

Impacted products

1 product

Vendor	Product	Version
MongoDB	Go Driver	Affected: 1.0.0 , < 1.17.10 (semver) Affected: 2.0.0 , < 2.9.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-88031",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T18:25:51.598529Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T18:25:57.644Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Go Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.17.10",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.9.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable."
            }
          ],
          "value": "Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-943",
              "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T17:59:35.845Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/GODRIVER-4081"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-88031",
    "datePublished": "2026-09-10T17:59:35.845Z",
    "dateReserved": "2026-09-09T19:49:39.183Z",
    "dateUpdated": "2026-09-10T18:25:57.644Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92615 (GCVE-0-2026-92615)

Vulnerability from cvelistv5 – Published: 2026-09-16 15:20 – Updated: 2026-11-13 12:27

Title

Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed

Summary

Severity

6.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 15:47 UTC

CWE

CWE-413 - Improper Resource Locking

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1210 records in the last 180 days details

References

7 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:94608	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:94612	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:94632	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:96291	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:96293	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-92615	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2518323	issue-trackingx_refsource_REDHAT

Impacted products

9 products

Vendor	Product	Version
Red Hat	RHEM 1.2 for RHEL 10	Unaffected: 0:1.2.2-1.el10 , < * (rpm) cpe:/a:redhat:edge_manager:1.2::el10 cpe:/a:redhat:edge_manager:1.2::el9
Red Hat	RHEM 1.2 for RHEL 9	Unaffected: 0:1.2.2-1.el9 , < * (rpm) cpe:/a:redhat:edge_manager:1.2::el10 cpe:/a:redhat:edge_manager:1.2::el9
Red Hat	Red Hat Edge Manager 1.2	Unaffected: 1793718463 , < * (rpm) cpe:/a:redhat:edge_manager:1.2::el10
Red Hat	Red Hat Edge Manager 1.2	Unaffected: 1793718887 , < * (rpm) cpe:/a:redhat:edge_manager:1.2::el9
Red Hat	Red Hat Edge Manager 1.3	Unaffected: 1793975984 , < * (rpm) cpe:/a:redhat:edge_manager:1.3::el10
Red Hat	Red Hat Edge Manager 1.3	Unaffected: 1793976378 , < * (rpm) cpe:/a:redhat:edge_manager:1.3::el10
Red Hat	Red Hat Edge Manager 1.3	Unaffected: 1793976255 , < * (rpm) cpe:/a:redhat:edge_manager:1.3::el9
Red Hat	Red Hat Edge Manager 1.3	Unaffected: 1793976043 , < * (rpm) cpe:/a:redhat:edge_manager:1.3::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	cpe:/a:redhat:acm:2

Date Public

2026-09-16 14:34

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92615",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T15:47:44.857928Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T15:48:00.418Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:edge_manager:1.2::el10",
            "cpe:/a:redhat:edge_manager:1.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "flightctl",
          "product": "RHEM 1.2 for RHEL 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.2.2-1.el10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:edge_manager:1.2::el10",
            "cpe:/a:redhat:edge_manager:1.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "flightctl",
          "product": "RHEM 1.2 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.2.2-1.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:edge_manager:1.2::el10"
          ],
          "defaultStatus": "affected",
          "packageName": "rhem/flightctl-worker-rhel10",
          "product": "Red Hat Edge Manager 1.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1793718463",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:edge_manager:1.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhem/flightctl-worker-rhel9",
          "product": "Red Hat Edge Manager 1.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1793718887",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:edge_manager:1.3::el10"
          ],
          "defaultStatus": "affected",
          "packageName": "rhem/flightctl-periodic-rhel10",
          "product": "Red Hat Edge Manager 1.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1793975984",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:edge_manager:1.3::el10"
          ],
          "defaultStatus": "affected",
          "packageName": "rhem/flightctl-worker-rhel10",
          "product": "Red Hat Edge Manager 1.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1793976378",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:edge_manager:1.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhem/flightctl-periodic-rhel9",
          "product": "Red Hat Edge Manager 1.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1793976255",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:edge_manager:1.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhem/flightctl-worker-rhel9",
          "product": "Red Hat Edge Manager 1.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1793976043",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:acm:2"
          ],
          "defaultStatus": "affected",
          "packageName": "flightctl",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-09-16T14:34:11.570Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git\u0027s process-global client.Protocols map via gitclient.InstallProtocol(\"https\", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant\u0027s repository configuration is written last wins for all in-flight git.Clone calls. \nThis race condition can cause one tenant\u0027s TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant\u0027s git operations."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-413",
              "description": "Improper Resource Locking",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T12:27:57.394Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:94608",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:94608"
        },
        {
          "name": "RHSA-2026:94612",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:94612"
        },
        {
          "name": "RHSA-2026:94632",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:94632"
        },
        {
          "name": "RHSA-2026:96291",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:96291"
        },
        {
          "name": "RHSA-2026:96293",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:96293"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-92615"
        },
        {
          "name": "RHBZ#2518323",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2518323"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-01T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-16T14:34:11.570Z",
          "value": "Made public."
        }
      ],
      "title": "Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed",
      "workarounds": [
        {
          "lang": "en",
          "value": "There is no application-level workaround that fully eliminates this race condition without a code change. The following deployment-level measures reduce exposure in multi-tenant environments:\n- Avoid mTLS client certificates for git repositories: If tenant Repository resources do not supply client TLS certificates (httpConfig.tls.clientCertificate), the most sensitive data (client private key material) is absent from the global transport and cannot leak.\n- Avoid skipServerVerification: Do not set httpConfig.skipServerVerification: true on any Repository resource. This prevents a tenant\u0027s InsecureSkipVerify=true from propagating to other tenants\u0027 clones, which would otherwise allow an on-path attacker to serve malicious configuration."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-413: Improper Resource Locking"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-92615",
    "datePublished": "2026-09-16T15:20:50.013Z",
    "dateReserved": "2026-09-16T14:27:41.693Z",
    "dateUpdated": "2026-11-13T12:27:57.394Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:94612

CVE-2026-102276 (GCVE-0-2026-102276)

CVE-2026-102278 (GCVE-0-2026-102278)

CVE-2026-73501 (GCVE-0-2026-73501)

CVE-2026-73502 (GCVE-0-2026-73502)

CVE-2026-77354 (GCVE-0-2026-77354)

CVE-2026-84445 (GCVE-0-2026-84445)

CVE-2026-88031 (GCVE-0-2026-88031)

CVE-2026-92615 (GCVE-0-2026-92615)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour