RHSA-2026:95267

Vulnerability from csaf_redhat - Published: 2026-11-04 16:31 - Updated: 2026-11-13 17:36
Summary
Red Hat Security Advisory: RHTAS 1.5.1 - Tech Preview Release Of the Sigstore A2A 0.0.2
Severity
Critical
Notes
Topic: The Tech Preview release of the Sigstore A2A image 0.0.2. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5
Details: The Sigstore A2A image can be used to sign and verify AI/ML workloads
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-63374

A flaw was found in AnyIO. A remote attacker in a privileged network position can bypass Transport Layer Security (TLS) certificate validation when connecting to internationalized domain names. This vulnerability occurs because the framework converts internationalized hostnames using an outdated encoding standard, Internationalizing Domain Names in Applications (IDNA) 2003 instead of IDNA 2008. If network traffic is redirected or intercepted, an attacker can present a legitimate certificate for the mismatched domain name, allowing them to impersonate the intended server and intercept or alter sensitive communications.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x —
Vendor Fix fix
Unresolved product id: Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64 —
Vendor Fix fix
Unresolved product id: Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64 —
Vendor Fix fix
Unresolved product id: Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le —
Vendor Fix fix
Threats
Impact Moderate
CVE-2026-97687

A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security (TLS) settings inadvertently overwrite the proxy's TLS configuration, which can disable certificate verification on reused connection contexts. Consequently, an attacker can impersonate the proxy to monitor or modify forwarded traffic or capture client credentials.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 4 products, the same list as for CVE-2026-63374
Threats
Impact Important
CVE-2026-97689

A flaw was found in urllib3. This flaw allows a Denial of Service (DoS) through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 4 products, the same list as for CVE-2026-63374
Threats
Impact Important
CVE-2026-102267

A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set (JWKS) endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an untrusted server, allowing the client to accept forged verification keys or potentially exposing sensitive credentials.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-346 - Origin Validation Error
Affected products
Fixed 4 products, the same list as for CVE-2026-63374
Threats
Impact Important
CVE-2026-102268

A flaw was found in PyJWT. When an application allows both symmetric and asymmetric signing algorithms, minor formatting variations in a public key can prevent the library from properly identifying it as an asymmetric key. Consequently, the library improperly treats the public key as a shared secret key, allowing a remote attacker to forge valid authentication tokens and bypass security controls.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-347 - Improper Verification of Cryptographic Signature
Affected products
Fixed 4 products, the same list as for CVE-2026-63374
Threats
Impact Critical
CVE-2026-102271

A flaw was found in PyJWT. The library fails to identify asymmetric public keys supplied in Distinguished Encoding Rules (DER) format, inadvertently treating the public data as a shared secret in Hash-based Message Authentication Code (HMAC) operations. If an application supports both asymmetric and symmetric signing algorithms, a remote attacker knowing the public key can exploit this flaw to forge valid authentication tokens and bypass access controls.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-347 - Improper Verification of Cryptographic Signature
Affected products
Fixed 4 products, the same list as for CVE-2026-63374
Threats
Impact Important
CVE-2026-102272

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key (JWK) parser fails to normalize Unicode byte-order marks (BOM). In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to misidentify the public key as a shared symmetric secret. This flaw allows an attacker to forge authenticated JSON Web Tokens (JWT) and bypass authentication controls.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-347 - Improper Verification of Cryptographic Signature
Affected products
Fixed 4 products, the same list as for CVE-2026-63374
Threats
Impact Important
CVE-2026-102273

A flaw was found in PyJWT. This vulnerability allows an unauthenticated remote attacker to bypass authentication by forging arbitrary JSON Web Tokens (JWTs). When an application allows both symmetric and asymmetric algorithms, PyJWT fails to properly validate public JSON Web Key (JWK) container representations, mistakenly accepting public key material as a symmetric Hash-based Message Authentication Code (HMAC) secret. As a result, an attacker with knowledge of the public key can generate validly signed tokens with arbitrary authenticated claims.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-347 - Improper Verification of Cryptographic Signature
Affected products
Fixed 4 products, the same list as for CVE-2026-63374
Threats
Impact Important
CVE-2026-114605

A flaw was found in dnspython. A remote attacker can cause a Denial of Service (DoS) by sending a specially crafted Domain Name System (DNS) message containing excessive compression pointer chains. Because the parser does not enforce a hop limit during name decompression, processing these malformed messages leads to excessive CPU utilization and application unresponsiveness.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-606 - Unchecked Input for Loop Condition
Affected products
Fixed 4 products, the same list as for CVE-2026-63374
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:95267 self
https://access.redhat.com/documentation/en-us/red… external
https://access.redhat.com/documentation/en-us/red… external
https://access.redhat.com/security/cve/CVE-2026-102267 external
https://access.redhat.com/security/cve/CVE-2026-102268 external
https://access.redhat.com/security/cve/CVE-2026-102271 external
https://access.redhat.com/security/cve/CVE-2026-102272 external
https://access.redhat.com/security/cve/CVE-2026-102273 external
https://access.redhat.com/security/cve/CVE-2026-114605 external
https://access.redhat.com/security/cve/CVE-2026-63374 external
https://access.redhat.com/security/cve/CVE-2026-97687 external
https://access.redhat.com/security/cve/CVE-2026-97689 external
https://access.redhat.com/security/updates/classi… external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-63374 self
https://bugzilla.redhat.com/show_bug.cgi?id=2538958 external
https://www.cve.org/CVERecord?id=CVE-2026-63374 external
https://nvd.nist.gov/vuln/detail/CVE-2026-63374 external
https://github.com/agronholm/anyio/commit/68f5891… external
https://github.com/agronholm/anyio/pull/1208 external
https://github.com/agronholm/anyio/releases/tag/4.14.2 external
https://github.com/agronholm/anyio/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-97687 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543255 external
https://www.cve.org/CVERecord?id=CVE-2026-97687 external
https://nvd.nist.gov/vuln/detail/CVE-2026-97687 external
https://github.com/urllib3/urllib3/commit/07408ce… external
https://github.com/urllib3/urllib3/commit/b644729… external
https://github.com/urllib3/urllib3/pull/5093 external
https://github.com/urllib3/urllib3/releases/tag/2.8.0 external
https://github.com/urllib3/urllib3/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-97689 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543245 external
https://www.cve.org/CVERecord?id=CVE-2026-97689 external
https://nvd.nist.gov/vuln/detail/CVE-2026-97689 external
https://github.com/urllib3/urllib3/commit/cd770b0… external
https://github.com/urllib3/urllib3/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-102267 self
https://bugzilla.redhat.com/show_bug.cgi?id=2542690 external
https://www.cve.org/CVERecord?id=CVE-2026-102267 external
https://nvd.nist.gov/vuln/detail/CVE-2026-102267 external
https://github.com/jpadilla/pyjwt/commit/0a795b8e… external
https://github.com/jpadilla/pyjwt/releases/tag/2.14.0 external
https://github.com/jpadilla/pyjwt/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-102268 self
https://bugzilla.redhat.com/show_bug.cgi?id=2542685 external
https://www.cve.org/CVERecord?id=CVE-2026-102268 external
https://nvd.nist.gov/vuln/detail/CVE-2026-102268 external
https://github.com/jpadilla/pyjwt/commit/8b4e233a… external
https://github.com/jpadilla/pyjwt/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-102271 self
https://bugzilla.redhat.com/show_bug.cgi?id=2542687 external
https://www.cve.org/CVERecord?id=CVE-2026-102271 external
https://nvd.nist.gov/vuln/detail/CVE-2026-102271 external
https://github.com/jpadilla/pyjwt/commit/2798504f… external
https://github.com/jpadilla/pyjwt/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-102272 self
https://bugzilla.redhat.com/show_bug.cgi?id=2542695 external
https://www.cve.org/CVERecord?id=CVE-2026-102272 external
https://nvd.nist.gov/vuln/detail/CVE-2026-102272 external
https://github.com/jpadilla/pyjwt/commit/18078393… external
https://github.com/jpadilla/pyjwt/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-102273 self
https://bugzilla.redhat.com/show_bug.cgi?id=2542697 external
https://www.cve.org/CVERecord?id=CVE-2026-102273 external
https://nvd.nist.gov/vuln/detail/CVE-2026-102273 external
https://github.com/jpadilla/pyjwt/commit/801cd128… external
https://github.com/jpadilla/pyjwt/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-114605 self
https://bugzilla.redhat.com/show_bug.cgi?id=2559128 external
https://www.cve.org/CVERecord?id=CVE-2026-114605 external
https://nvd.nist.gov/vuln/detail/CVE-2026-114605 external
https://github.com/rthalley/dnspython/commit/b485… external
https://github.com/rthalley/dnspython/releases/ta… external
https://github.com/rthalley/dnspython/security/ad… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The Tech Preview release of the Sigstore A2A image 0.0.2.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Sigstore A2A image can be used to sign and verify AI/ML workloads",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:95267",
        "url": "https://access.redhat.com/errata/RHSA-2026:95267"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-102267",
        "url": "https://access.redhat.com/security/cve/CVE-2026-102267"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-102268",
        "url": "https://access.redhat.com/security/cve/CVE-2026-102268"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-102271",
        "url": "https://access.redhat.com/security/cve/CVE-2026-102271"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-102272",
        "url": "https://access.redhat.com/security/cve/CVE-2026-102272"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-102273",
        "url": "https://access.redhat.com/security/cve/CVE-2026-102273"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-114605",
        "url": "https://access.redhat.com/security/cve/CVE-2026-114605"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-63374",
        "url": "https://access.redhat.com/security/cve/CVE-2026-63374"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-97687",
        "url": "https://access.redhat.com/security/cve/CVE-2026-97687"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-97689",
        "url": "https://access.redhat.com/security/cve/CVE-2026-97689"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95267.json"
      }
    ],
    "title": "Red Hat Security Advisory: RHTAS 1.5.1 - Tech Preview Release Of the Sigstore A2A 0.0.2",
    "tracking": {
      "current_release_date": "2026-11-13T17:36:40+00:00",
      "generator": {
        "date": "2026-11-13T17:36:40+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.6"
        }
      },
      "id": "RHSA-2026:95267",
      "initial_release_date": "2026-11-04T16:31:55+00:00",
      "revision_history": [
        {
          "date": "2026-11-04T16:31:55+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-04T16:32:04+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-13T17:36:40+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Trusted Artifact Signer 1.5",
                "product": {
                  "name": "Red Hat Trusted Artifact Signer 1.5",
                  "product_id": "Red Hat Trusted Artifact Signer 1.5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:trusted_artifact_signer:1.5::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Trusted Artifact Signer"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
                  "product_id": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rh-sigstore-a2a-rhel9@sha256%3A7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9\u0026tag=1793624122"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
                "product": {
                  "name": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
                  "product_id": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rh-sigstore-a2a-rhel9@sha256%3A820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58?arch=arm64\u0026repository_url=registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9\u0026tag=1793624122"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le",
                  "product_id": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rh-sigstore-a2a-rhel9@sha256%3Ae6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174?arch=ppc64le\u0026repository_url=registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9\u0026tag=1793624122"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
                "product": {
                  "name": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
                  "product_id": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rh-sigstore-a2a-rhel9@sha256%3A1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1?arch=s390x\u0026repository_url=registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9\u0026tag=1793624122"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x as a component of Red Hat Trusted Artifact Signer 1.5",
          "product_id": "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x"
        },
        "product_reference": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64 as a component of Red Hat Trusted Artifact Signer 1.5",
          "product_id": "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64 as a component of Red Hat Trusted Artifact Signer 1.5",
          "product_id": "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64"
        },
        "product_reference": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le as a component of Red Hat Trusted Artifact Signer 1.5",
          "product_id": "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-63374",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-09-22T21:49:20.725016+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2538958"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in AnyIO. A remote attacker in a privileged network position can bypass Transport Layer Security (TLS) certificate validation when connecting to internationalized domain names. This vulnerability occurs because the framework converts internationalized hostnames using an outdated encoding standard, Internationalizing Domain Names in Applications (IDNA) 2003 instead of IDNA 2008. If network traffic is redirected or intercepted, an attacker can present a legitimate certificate for the mismatched domain name, allowing them to impersonate the intended server and intercept or alter sensitive communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "anyio: AnyIO: TLS certificate spoofing via improper internationalized domain name encoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having a Moderate severity for Red Hat products because exploitation requires an attacker to already be positioned to intercept network traffic, and the flaw only manifests when connecting to internationalized domain names containing non-ASCII characters. Within Red Hat supported environments and containerized AI components, workloads predominantly communicate using standard ASCII fully qualified domain names and internal endpoints. Because the defect does not allow remote code execution and requires a prior man-in-the-middle condition, the overall blast radius is constrained to specific redirected sessions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-63374"
        },
        {
          "category": "external",
          "summary": "RHBZ#2538958",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538958"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-63374",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-63374"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63374",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63374"
        },
        {
          "category": "external",
          "summary": "https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce",
          "url": "https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce"
        },
        {
          "category": "external",
          "summary": "https://github.com/agronholm/anyio/pull/1208",
          "url": "https://github.com/agronholm/anyio/pull/1208"
        },
        {
          "category": "external",
          "summary": "https://github.com/agronholm/anyio/releases/tag/4.14.2",
          "url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6",
          "url": "https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6"
        }
      ],
      "release_date": "2026-09-22T15:23:14.259000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-04T16:31:55+00:00",
          "details": "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95267"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "anyio: AnyIO: TLS certificate spoofing via improper internationalized domain name encoding"
    },
    {
      "cve": "CVE-2026-97687",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-09-29T15:44:25.449046+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543255"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security (TLS) settings inadvertently overwrite the proxy\u0027s TLS configuration, which can disable certificate verification on reused connection contexts. Consequently, an attacker can impersonate the proxy to monitor or modify forwarded traffic or capture client credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability as having an Important impact because a network attacker can exploit corrupted TLS validation states to impersonate an HTTPS proxy, enabling complete interception and manipulation of sensitive communications as well as client credential theft. Successful exploitation depends on specialized application architectures where outgoing requests utilize an HTTPS-capable proxy alongside customized destination TLS parameters that inadvertently override proxy verification. Default Red Hat enterprise deployments that communicate directly with endpoints, utilize traditional HTTP proxies, or rely on standard CONNECT tunneling for end-to-end encryption do not expose this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97687"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543255",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543255"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97687",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97687"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97687",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97687"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465",
          "url": "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3",
          "url": "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/pull/5093",
          "url": "https://github.com/urllib3/urllib3/pull/5093"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/releases/tag/2.8.0",
          "url": "https://github.com/urllib3/urllib3/releases/tag/2.8.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"
        }
      ],
      "release_date": "2026-09-29T15:30:27.136000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-04T16:31:55+00:00",
          "details": "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95267"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override"
    },
    {
      "cve": "CVE-2026-97689",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-29T15:41:38.807723+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543245"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3. This flaw allows a Denial of Service (DoS) through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important impact because an untrusted remote server can trigger process crashes and complete denial of service across client applications without requiring authentication or special privileges. In Red Hat environments, urllib3 is integrated across numerous system tools, container workloads, and platform services to handle outbound web communication. The risk specifically manifests when these services process streamed replies from potentially malicious third-party endpoints, whereas workloads restricted to internal or verified infrastructure remain largely unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97689"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543245",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543245"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97689",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97689"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97689",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97689"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed",
          "url": "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/releases/tag/2.8.0",
          "url": "https://github.com/urllib3/urllib3/releases/tag/2.8.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw"
        }
      ],
      "release_date": "2026-09-29T15:36:05.963000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-04T16:31:55+00:00",
          "details": "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95267"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser"
    },
    {
      "cve": "CVE-2026-102267",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-09-28T20:42:16.576688+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2542690"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set (JWKS) endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an untrusted server, allowing the client to accept forged verification keys or potentially exposing sensitive credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important impact because improper handling of HTTP redirects during dynamic key retrieval can allow an adversary to supply forged cryptographic keys or intercept sensitive request headers. In Red Hat environments where services utilize PyJWKClient to fetch JSON Web Key Sets over the network, accepting untrusted key material may compromise token validation and authentication boundaries. Exploitation requires the target service to dynamically resolve keys via HTTP and relies on an attacker\u0027s ability to manipulate responses returned by the configured key server.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102267"
        },
        {
          "category": "external",
          "summary": "RHBZ#2542690",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542690"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102267",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102267"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102267",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102267"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56",
          "url": "https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0",
          "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj",
          "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj"
        }
      ],
      "release_date": "2026-09-28T20:23:33.556000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-04T16:31:55+00:00",
          "details": "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95267"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects"
    },
    {
      "cve": "CVE-2026-102268",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-09-28T20:40:56.952621+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2542685"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PyJWT. When an application allows both symmetric and asymmetric signing algorithms, minor formatting variations in a public key can prevent the library from properly identifying it as an asymmetric key. Consequently, the library improperly treats the public key as a shared secret key, allowing a remote attacker to forge valid authentication tokens and bypass security controls.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Critical severity for Red Hat products because an unauthenticated remote attacker could forge valid cryptographic tokens and bypass authentication checks without knowing the private signing key. Exploitation occurs when consuming applications configure token verification to accept both symmetric and asymmetric algorithms simultaneously, allowing an asymmetric public key to be mishandled as a symmetric secret. Deployments that strictly enforce a single algorithm type or validate tokens using JSON Web Key sets do not permit this algorithm confusion and remain unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102268"
        },
        {
          "category": "external",
          "summary": "RHBZ#2542685",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542685"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102268",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102268"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102268",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102268"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07",
          "url": "https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0",
          "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9",
          "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9"
        }
      ],
      "release_date": "2026-09-28T20:26:13.674000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-04T16:31:55+00:00",
          "details": "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95267"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation"
    },
    {
      "cve": "CVE-2026-102271",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-09-28T20:41:35.219179+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2542687"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PyJWT. The library fails to identify asymmetric public keys supplied in Distinguished Encoding Rules (DER) format, inadvertently treating the public data as a shared secret in Hash-based Message Authentication Code (HMAC) operations. If an application supports both asymmetric and symmetric signing algorithms, a remote attacker knowing the public key can exploit this flaw to forge valid authentication tokens and bypass access controls.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because an attacker can forge valid JSON Web Tokens and bypass authentication mechanisms if public cryptographic keys are mistakenly treated as shared secrets. Exploitation requires a specific application scenario where both asymmetric and HMAC algorithms are concurrently permitted during signature verification and public keys are provided in raw DER binary format. Typical Red Hat product integrations do not employ this vulnerable algorithm combination or key encoding by default, which restricts the overall attack surface in standard production environments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102271"
        },
        {
          "category": "external",
          "summary": "RHBZ#2542687",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542687"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102271",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102271"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102271",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102271"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499",
          "url": "https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0",
          "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773",
          "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773"
        }
      ],
      "release_date": "2026-09-28T20:31:53.066000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-04T16:31:55+00:00",
          "details": "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95267"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets"
    },
    {
      "cve": "CVE-2026-102272",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-09-28T20:51:42.409127+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2542695"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key (JWK) parser fails to normalize Unicode byte-order marks (BOM). In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to misidentify the public key as a shared symmetric secret. This flaw allows an attacker to forge authenticated JSON Web Tokens (JWT) and bypass authentication controls.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity because successful exploitation permits an unauthenticated remote attacker to bypass authentication and forge valid tokens, though exploitation requires specific mixed-algorithm verification settings. In Red Hat environments, exposure is restricted to services that simultaneously allow both symmetric HMAC and asymmetric signature algorithms while parsing public keys that contain byte order marks. Workloads and services that enforce single-algorithm verification policies or utilize standard asymmetric key validation routines are not susceptible to this attack.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102272"
        },
        {
          "category": "external",
          "summary": "RHBZ#2542695",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542695"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102272",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102272"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102272",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102272"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291",
          "url": "https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0",
          "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947",
          "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947"
        }
      ],
      "release_date": "2026-09-28T20:36:31.530000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-04T16:31:55+00:00",
          "details": "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95267"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling"
    },
    {
      "cve": "CVE-2026-102273",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-09-28T20:52:12.127939+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2542697"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PyJWT. This vulnerability allows an unauthenticated remote attacker to bypass authentication by forging arbitrary JSON Web Tokens (JWTs). When an application allows both symmetric and asymmetric algorithms, PyJWT fails to properly validate public JSON Web Key (JWK) container representations, mistakenly accepting public key material as a symmetric Hash-based Message Authentication Code (HMAC) secret. As a result, an attacker with knowledge of the public key can generate validly signed tokens with arbitrary authenticated claims.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as Important because an attacker with access to a public verification key can forge cryptographic tokens to bypass authentication, allowing impersonation of privileged users and unauthorized access to protected application resources. Exploitation is limited to environments where applications concurrently permit symmetric HMAC and asymmetric algorithms while passing public key containers into validation routines.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102273"
        },
        {
          "category": "external",
          "summary": "RHBZ#2542697",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542697"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102273",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102273"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102273",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102273"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95",
          "url": "https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0",
          "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w",
          "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w"
        }
      ],
      "release_date": "2026-09-28T20:38:28.161000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-04T16:31:55+00:00",
          "details": "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95267"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets"
    },
    {
      "cve": "CVE-2026-114605",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-10-22T16:42:27.165994+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2559128"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in dnspython. A remote attacker can cause a Denial of Service (DoS) by sending a specially crafted Domain Name System (DNS) message containing excessive compression pointer chains. Because the parser does not enforce a hop limit during name decompression, processing these malformed messages leads to excessive CPU utilization and application unresponsiveness.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important impact because an unauthenticated remote attacker can trigger complete CPU exhaustion and application unresponsiveness without requiring specialized access or privileges. In Red Hat enterprise deployments, the library is embedded across multiple platform services and containerized environments that process network records. Systems are primarily vulnerable when applications accept and decompress wire-format responses from untrusted external name servers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
          "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-114605"
        },
        {
          "category": "external",
          "summary": "RHBZ#2559128",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559128"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-114605",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-114605"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114605",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114605"
        },
        {
          "category": "external",
          "summary": "https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023",
          "url": "https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023"
        },
        {
          "category": "external",
          "summary": "https://github.com/rthalley/dnspython/releases/tag/v2.9.0",
          "url": "https://github.com/rthalley/dnspython/releases/tag/v2.9.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m",
          "url": "https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m"
        }
      ],
      "release_date": "2026-10-22T16:25:32.509000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-04T16:31:55+00:00",
          "details": "The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.\n\nFor details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95267"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:1930392647c6089de060b4088db8640c1c576f28c2af2e2e4cbb82ab01740ad1_s390x",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:7eada463b6614df33535714150d3b7095ae31ef9752608029ff4c6b43a3dcd8e_amd64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:820df908c211516640edb090aa0f822ab333caed936dce4112486e4b858add58_arm64",
            "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9@sha256:e6b82e69b9659949d385c5b0c4047e4e94a3255a77973ec565eeb5e466eb6174_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.