RHSA-2026:95755
Vulnerability from csaf_redhat - Published: 2026-11-11 12:38 - Updated: 2026-11-12 06:05Summary
Red Hat Security Advisory: OpenShift Container Platform 4.15.71 bug fix and security update
Severity
Critical
Notes
Topic: Red Hat OpenShift Container Platform release 4.15.71 is now available with updates to packages and images that fix several bugs and add enhancements.
This release includes a security update for Red Hat OpenShift Container Platform 4.15.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.15.71. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:95754
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/
Security Fix(es):
* sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313)
* kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)
* kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564)
* pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145)
* pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161)
* pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111)
* setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273)
* gnutls: gnutls: Security bypass due to incorrect name constraint handling (CVE-2026-42011)
* gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name (CVE-2026-42013)
* kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A path traversal vulnerability in the Python setuptools library allows attackers with limited system access to write files outside the intended temporary directory by manipulating package download URLs. This flaw bypasses basic filename sanitization and can lead to unauthorized overwrites of important system files, creating opportunities for further compromise. While it doesn't expose data or require user interaction, it poses a high integrity risk and is especially concerning in environments that rely on automated package handling or internal tooling built on setuptools.
7.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.
7.6 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-47273
Threats
Impact
Important
A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.
7.4 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-47273
Threats
Impact
Moderate
A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.
8.2 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-47273
Threats
Impact
Moderate
A flaw was found in the Linux kernel's netfilter component, specifically within the `nft_set_pipapo_avx2` AVX2 matching functions. This vulnerability occurs when a `pipapo` set with an 'ipv4 . port' key is reloaded. Due to incorrect masking, the system may erroneously identify non-matching elements as duplicates, leading to data integrity issues and unexpected behavior. A remote attacker could potentially exploit this to cause a denial of service or impact data integrity.
8.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-47273
Threats
Impact
Important
A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF (Add IP Address Configuration) chunks, including DEL-IP (Delete IP Address) parameters, to trigger a use-after-free condition. This memory corruption could lead to a system crash, resulting in a denial of service, and potentially allow for arbitrary code execution.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-47273
Threats
Impact
Important
A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.
8.2 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-47273
Threats
Impact
Important
A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.
7.4 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-47273
Threats
Impact
Important
A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol (TCP) connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could exploit this vulnerability by sending specially timed network requests, triggering a use-after-free condition. This could results in system crash leading to a Denial of Service (DoS), memory corruption, or remote code execution.
9.8 (Critical)
Affected products
Fixed
4 products, the same list as for
CVE-2025-47273
Threats
Impact
Critical
A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).
7.6 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-47273
Threats
Impact
Important
References
68 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Container Platform release 4.15.71 is now available with updates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.15.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container Platform 4.15.71. See the following advisory for the RPM packages for this release:\n\nhttps://access.redhat.com/errata/RHSA-2026:95754\n\nSpace precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nSecurity Fix(es):\n\n* sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313)\n* kernel: netfilter: nft_set_pipapo_avx2: don\u0027t return non-matching entry on expiry (CVE-2026-43114)\n* kernel: sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing (CVE-2026-64564)\n* pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145)\n* pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161)\n* pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111)\n* setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273)\n* gnutls: gnutls: Security bypass due to incorrect name constraint handling (CVE-2026-42011)\n* gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name (CVE-2026-42013)\n* kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:95755",
"url": "https://access.redhat.com/errata/RHSA-2026:95755"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "2366982",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2366982"
},
{
"category": "external",
"summary": "2466994",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466994"
},
{
"category": "external",
"summary": "2467437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
},
{
"category": "external",
"summary": "2467448",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
},
{
"category": "external",
"summary": "2502845",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502845"
},
{
"category": "external",
"summary": "2510890",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510890"
},
{
"category": "external",
"summary": "2528993",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528993"
},
{
"category": "external",
"summary": "2531747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531747"
},
{
"category": "external",
"summary": "2543797",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543797"
},
{
"category": "external",
"summary": "2553390",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553390"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95755.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.15.71 bug fix and security update",
"tracking": {
"current_release_date": "2026-11-12T06:05:57+00:00",
"generator": {
"date": "2026-11-12T06:05:57+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.5"
}
},
"id": "RHSA-2026:95755",
"initial_release_date": "2026-11-11T12:38:51+00:00",
"revision_history": [
{
"date": "2026-11-11T12:38:51+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-11T12:38:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-12T06:05:57+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.15",
"product": {
"name": "Red Hat OpenShift Container Platform 4.15",
"product_id": "9Base-RHOSE-4.15",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.15::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-aarch64-415.92.202611051005-0",
"product": {
"name": "rhcos-aarch64-415.92.202611051005-0",
"product_id": "rhcos-aarch64-415.92.202611051005-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@415.92.202611051005?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-ppc64le-415.92.202611051005-0",
"product": {
"name": "rhcos-ppc64le-415.92.202611051005-0",
"product_id": "rhcos-ppc64le-415.92.202611051005-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@415.92.202611051005?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-s390x-415.92.202611051005-0",
"product": {
"name": "rhcos-s390x-415.92.202611051005-0",
"product_id": "rhcos-s390x-415.92.202611051005-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@415.92.202611051005?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-x86_64-415.92.202611051005-0",
"product": {
"name": "rhcos-x86_64-415.92.202611051005-0",
"product_id": "rhcos-x86_64-415.92.202611051005-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@415.92.202611051005?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-aarch64-415.92.202611051005-0 as a component of Red Hat OpenShift Container Platform 4.15",
"product_id": "9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0"
},
"product_reference": "rhcos-aarch64-415.92.202611051005-0",
"relates_to_product_reference": "9Base-RHOSE-4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-ppc64le-415.92.202611051005-0 as a component of Red Hat OpenShift Container Platform 4.15",
"product_id": "9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0"
},
"product_reference": "rhcos-ppc64le-415.92.202611051005-0",
"relates_to_product_reference": "9Base-RHOSE-4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-s390x-415.92.202611051005-0 as a component of Red Hat OpenShift Container Platform 4.15",
"product_id": "9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0"
},
"product_reference": "rhcos-s390x-415.92.202611051005-0",
"relates_to_product_reference": "9Base-RHOSE-4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-x86_64-415.92.202611051005-0 as a component of Red Hat OpenShift Container Platform 4.15",
"product_id": "9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
},
"product_reference": "rhcos-x86_64-415.92.202611051005-0",
"relates_to_product_reference": "9Base-RHOSE-4.15"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-47273",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory"
},
"discovery_date": "2025-05-17T16:00:41.145177+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2366982"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal vulnerability in the Python setuptools library allows attackers with limited system access to write files outside the intended temporary directory by manipulating package download URLs. This flaw bypasses basic filename sanitization and can lead to unauthorized overwrites of important system files, creating opportunities for further compromise. While it doesn\u0027t expose data or require user interaction, it poses a high integrity risk and is especially concerning in environments that rely on automated package handling or internal tooling built on setuptools.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "setuptools: Path Traversal Vulnerability in setuptools PackageIndex",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this vulnerability \"Moderate\" based on the impact of the damage caused by a successful exploitation and the pre-requisites.\n\n* Exploitation requires that the attacker have limited code execution access to a Python environment where they can trigger the vulnerable PackageIndex.download() function\u2014this might be via a script, plugin, or automated job. Full admin rights aren\u0027t needed but a user with no access at all will be unable to exploit this vulnerability.\n* The vulnerability impacts the integrity of the system within the same security boundary\u2014it does not enable access or compromise across trust boundaries (e.g., from one container to another or from user space to kernel).\n* Successful exploitation only allows the attacker to \"create\" new files. The vulnerability does not provide access to existing files and by an extension to any confidential information. \n* Arbitrary file writes can overwrite critical config files, executables, or scripts. This can lead to persistent code execution, system misconfiguration, or unauthorized behavior, especially in automated environments. While overwriting critical files could theoretically lead to service disruption, the vulnerability in isolation does not inherently cause denial of service. The exploit doesn\u0027t target availability directly, and in many cases, systems may continue running.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-47273"
},
{
"category": "external",
"summary": "RHBZ#2366982",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2366982"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-47273",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47273"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-47273",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47273"
},
{
"category": "external",
"summary": "https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88",
"url": "https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88"
},
{
"category": "external",
"summary": "https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b",
"url": "https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b"
},
{
"category": "external",
"summary": "https://github.com/pypa/setuptools/issues/4946",
"url": "https://github.com/pypa/setuptools/issues/4946"
},
{
"category": "external",
"summary": "https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf",
"url": "https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf"
}
],
"release_date": "2025-05-17T15:46:11.399000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T12:38:51+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:f38b4b30160584e04166a69480438f34538cb8ad2dbc2db5a0efb0fa34e99af0\n\n (For s390x architecture)\n The image digest is sha256:9a82abfd20b4a0186cf145e06e93384148965cd6dfa26c03ca7345a7f93b74da\n\n (For ppc64le architecture)\n The image digest is sha256:91ffe8aae3a77385414d59688108ce407ea1830fe62e614d150b777414850aab\n\n (For aarch64 architecture)\n The image digest is sha256:30be43aad83a65ed696199caec931c70fe0572b2b977f7fe77069cb57b26d56f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95755"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "setuptools: Path Traversal Vulnerability in setuptools PackageIndex"
},
{
"acknowledgments": [
{
"names": [
"Shaomin Chen"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2026-16313",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences"
},
"discovery_date": "2026-06-01T18:13:24+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2502845"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "sg3_utils versions 1.34 through 1.48 contain a command injection flaw in the export_dev_ids() function of sg_inq. When sg_inq --export processes SCSI device identification data from VPD page 0x83, the SCSI name string designator (type 8) and the ATA vendor-ID subfield are printed without sanitizing embedded control characters. A crafted SCSI/USB device can embed a newline in this field, splitting sg_inq\u0027s udev KEY=VALUE output into two lines and injecting an arbitrary udev property, including REMOVE_CMD. On systems whose default udev rules invoke sg_inq --export for SCSI device identification and act on REMOVE_CMD when a device is removed, this allows a local attacker with physical access to a USB/SCSI port to achieve arbitrary command execution as root simply by disconnecting the crafted device.\n\nExploitation requires physical access to attach the malicious device, consistent with Red Hat\u0027s Physical (AV:P) attack vector scoring. The upstream fix (udev-conforming character escaping for this field) has not yet been included in any tagged sg3_utils release; all Red Hat-shipped versions of sg3_utils in the 1.34-1.48 range are affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16313"
},
{
"category": "external",
"summary": "RHBZ#2502845",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502845"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16313"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16313",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16313"
},
{
"category": "external",
"summary": "https://github.com/doug-gilbert/sg3_utils/pull/83",
"url": "https://github.com/doug-gilbert/sg3_utils/pull/83"
}
],
"release_date": "2026-06-01T18:13:24+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T12:38:51+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:f38b4b30160584e04166a69480438f34538cb8ad2dbc2db5a0efb0fa34e99af0\n\n (For s390x architecture)\n The image digest is sha256:9a82abfd20b4a0186cf145e06e93384148965cd6dfa26c03ca7345a7f93b74da\n\n (For ppc64le architecture)\n The image digest is sha256:91ffe8aae3a77385414d59688108ce407ea1830fe62e614d150b777414850aab\n\n (For aarch64 architecture)\n The image digest is sha256:30be43aad83a65ed696199caec931c70fe0572b2b977f7fe77069cb57b26d56f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95755"
},
{
"category": "workaround",
"details": "Remove or comment out the REMOVE_CMD rule from 50-udev-default.rules to prevent command execution on device removal. Alternatively, if automatic SCSI device identification is not required, disable the udev rule that invokes sg_inq --export on device connection.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export"
},
{
"acknowledgments": [
{
"names": [
"Haruto Kimura"
],
"organization": "Stella"
}
],
"cve": "CVE-2026-42011",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-06T19:06:25.319000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467437"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Security bypass due to incorrect name constraint handling",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42011"
},
{
"category": "external",
"summary": "RHBZ#2467437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42011"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42011",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42011"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T12:38:51+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:f38b4b30160584e04166a69480438f34538cb8ad2dbc2db5a0efb0fa34e99af0\n\n (For s390x architecture)\n The image digest is sha256:9a82abfd20b4a0186cf145e06e93384148965cd6dfa26c03ca7345a7f93b74da\n\n (For ppc64le architecture)\n The image digest is sha256:91ffe8aae3a77385414d59688108ce407ea1830fe62e614d150b777414850aab\n\n (For aarch64 architecture)\n The image digest is sha256:30be43aad83a65ed696199caec931c70fe0572b2b977f7fe77069cb57b26d56f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95755"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: gnutls: Security bypass due to incorrect name constraint handling"
},
{
"acknowledgments": [
{
"names": [
"Haruto Kimura"
],
"organization": "Stella"
},
{
"names": [
"Joshua Rogers"
],
"organization": "AISLE Research Team"
}
],
"cve": "CVE-2026-42013",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-06T19:47:00.134000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467448"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having a Moderate impact across affected Red Hat products because successful exploitation requires an active man-in-the-middle network position as well as a certificate issued by a trusted authority matching the target hostname\u0027s Common Name. Although TLS clients using GnuTLS on Red Hat Enterprise Linux and OpenShift are susceptible to improper certificate acceptance under these conditions, modern certificate authorities rarely issue certificates that omit valid Subject Alternative Names, substantially restricting practical threat vectors. Applications functioning exclusively as TLS servers or utilizing alternative cryptographic libraries like OpenSSL are not exposed to this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42013"
},
{
"category": "external",
"summary": "RHBZ#2467448",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42013",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42013"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42013",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42013"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T12:38:51+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:f38b4b30160584e04166a69480438f34538cb8ad2dbc2db5a0efb0fa34e99af0\n\n (For s390x architecture)\n The image digest is sha256:9a82abfd20b4a0186cf145e06e93384148965cd6dfa26c03ca7345a7f93b74da\n\n (For ppc64le architecture)\n The image digest is sha256:91ffe8aae3a77385414d59688108ce407ea1830fe62e614d150b777414850aab\n\n (For aarch64 architecture)\n The image digest is sha256:30be43aad83a65ed696199caec931c70fe0572b2b977f7fe77069cb57b26d56f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95755"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name"
},
{
"cve": "CVE-2026-43114",
"cwe": {
"id": "CWE-480",
"name": "Use of Incorrect Operator"
},
"discovery_date": "2026-05-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466994"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s netfilter component, specifically within the `nft_set_pipapo_avx2` AVX2 matching functions. This vulnerability occurs when a `pipapo` set with an \u0027ipv4 . port\u0027 key is reloaded. Due to incorrect masking, the system may erroneously identify non-matching elements as duplicates, leading to data integrity issues and unexpected behavior. A remote attacker could potentially exploit this to cause a denial of service or impact data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: netfilter: nft_set_pipapo_avx2: don\u0027t return non-matching entry on expiry",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Linux kernel\u0027s netfilter component, specifically within the `nft_set_pipapo_avx2` functionality. Incorrect processing during AVX2 matching operations can lead to misidentification of network data entries, potentially causing unexpected network filtering behavior and data integrity problems. This issue primarily impacts Red Hat Enterprise Linux 9 and 10 systems configured to utilize AVX2 instructions for netfilter set processing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43114"
},
{
"category": "external",
"summary": "RHBZ#2466994",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466994"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43114",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43114"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43114",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43114"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026050626-CVE-2026-43114-5deb@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026050626-CVE-2026-43114-5deb@gregkh/T"
}
],
"release_date": "2026-05-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T12:38:51+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:f38b4b30160584e04166a69480438f34538cb8ad2dbc2db5a0efb0fa34e99af0\n\n (For s390x architecture)\n The image digest is sha256:9a82abfd20b4a0186cf145e06e93384148965cd6dfa26c03ca7345a7f93b74da\n\n (For ppc64le architecture)\n The image digest is sha256:91ffe8aae3a77385414d59688108ce407ea1830fe62e614d150b777414850aab\n\n (For aarch64 architecture)\n The image digest is sha256:30be43aad83a65ed696199caec931c70fe0572b2b977f7fe77069cb57b26d56f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95755"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: netfilter: nft_set_pipapo_avx2: don\u0027t return non-matching entry on expiry"
},
{
"cve": "CVE-2026-64564",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-08-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510890"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF (Add IP Address Configuration) chunks, including DEL-IP (Delete IP Address) parameters, to trigger a use-after-free condition. This memory corruption could lead to a system crash, resulting in a denial of service, and potentially allow for arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact on Red Hat Enterprise Linux because memory corruption within kernel space can lead to a system-wide denial of service or facilitate privilege escalation. However, the SCTP kernel module is not loaded by default on standard Red Hat installations unless explicitly configured or required by running applications. Consequently, exposure is limited to environments where SCTP services are actively utilized or where local unprivileged users can trigger module loading.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64564"
},
{
"category": "external",
"summary": "RHBZ#2510890",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510890"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64564"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64564",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64564"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64564-6762@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64564-6762@gregkh/T"
}
],
"release_date": "2026-08-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T12:38:51+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:f38b4b30160584e04166a69480438f34538cb8ad2dbc2db5a0efb0fa34e99af0\n\n (For s390x architecture)\n The image digest is sha256:9a82abfd20b4a0186cf145e06e93384148965cd6dfa26c03ca7345a7f93b74da\n\n (For ppc64le architecture)\n The image digest is sha256:91ffe8aae3a77385414d59688108ce407ea1830fe62e614d150b777414850aab\n\n (For aarch64 architecture)\n The image digest is sha256:30be43aad83a65ed696199caec931c70fe0572b2b977f7fe77069cb57b26d56f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95755"
},
{
"category": "workaround",
"details": "To mitigate this issue, prevent the `sctp` kernel module from loading. Create a file named `/etc/modprobe.d/disable-sctp.conf` with the following content:\n\n```\ninstall sctp /bin/true\nblacklist sctp\n```\n\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Applications or services that rely on the SCTP protocol cannot use this mitigation and should prioritize applying the fix.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing"
},
{
"cve": "CVE-2026-86145",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-05T05:20:54.676360+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528993"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: An out-of-bounds write vulnerability in the PCRE2 library, specifically within the `pcre2_dfa_match` function, could allow arbitrary code execution. This flaw is exploitable in Red Hat products when processing attacker-controlled regular expressions or when a recursive pattern is used in conjunction with a small, API-set heap limit, making it dependent on specific application usage patterns.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86145"
},
{
"category": "external",
"summary": "RHBZ#2528993",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528993"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86145"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf",
"url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf"
}
],
"release_date": "2026-09-05T05:09:25.571000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T12:38:51+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:f38b4b30160584e04166a69480438f34538cb8ad2dbc2db5a0efb0fa34e99af0\n\n (For s390x architecture)\n The image digest is sha256:9a82abfd20b4a0186cf145e06e93384148965cd6dfa26c03ca7345a7f93b74da\n\n (For ppc64le architecture)\n The image digest is sha256:91ffe8aae3a77385414d59688108ce407ea1830fe62e614d150b777414850aab\n\n (For aarch64 architecture)\n The image digest is sha256:30be43aad83a65ed696199caec931c70fe0572b2b977f7fe77069cb57b26d56f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95755"
},
{
"category": "workaround",
"details": "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches\u2014such as the reuse of cached memory workspaces\u2014enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions"
},
{
"cve": "CVE-2026-89161",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-09-11T04:21:06.963234+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531747"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important memory corruption vulnerability in PCRE2\u0027s JIT compiler. An attacker could exploit a flaw in `pcre2_jit_match` when a previously copied subject is passed as context, potentially leading to arbitrary code execution or denial of service. The high attack complexity and local attack vector reduce the overall risk, but the widespread use of PCRE2 and the potential for severe impact warrant the Important classification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89161"
},
{
"category": "external",
"summary": "RHBZ#2531747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89161",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89161"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/pull/937",
"url": "https://github.com/PCRE2Project/pcre2/pull/937"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
}
],
"release_date": "2026-09-11T04:11:51.666000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T12:38:51+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:f38b4b30160584e04166a69480438f34538cb8ad2dbc2db5a0efb0fa34e99af0\n\n (For s390x architecture)\n The image digest is sha256:9a82abfd20b4a0186cf145e06e93384148965cd6dfa26c03ca7345a7f93b74da\n\n (For ppc64le architecture)\n The image digest is sha256:91ffe8aae3a77385414d59688108ce407ea1830fe62e614d150b777414850aab\n\n (For aarch64 architecture)\n The image digest is sha256:30be43aad83a65ed696199caec931c70fe0572b2b977f7fe77069cb57b26d56f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95755"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match"
},
{
"cve": "CVE-2026-98432",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-10-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553390"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol (TCP) connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could exploit this vulnerability by sending specially timed network requests, triggering a use-after-free condition. This could results in system crash leading to a Denial of Service (DoS), memory corruption, or remote code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Critical severity for Red Hat Enterprise Linux because it allows an unauthenticated remote attacker to cause kernel memory corruption or an immediate system crash over standard IPv4 TCP network traffic without requiring local privileges or user interaction. In default enterprise configurations across Red Hat environments, TCP services accept incoming connections without specialized tuning, making the concurrent connection handling paths inherently exposed to remote networks. Although reliably executing arbitrary code through this timing-sensitive use-after-free scenario requires precise heap control, the lack of network prerequisites and the potential for severe system instability elevate the impact above Important.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-98432"
},
{
"category": "external",
"summary": "RHBZ#2553390",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553390"
},
{
"category": "external",
"summary": "RHSB-2026-016",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-016"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-98432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-98432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98432"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox"
}
],
"release_date": "2026-10-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T12:38:51+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:f38b4b30160584e04166a69480438f34538cb8ad2dbc2db5a0efb0fa34e99af0\n\n (For s390x architecture)\n The image digest is sha256:9a82abfd20b4a0186cf145e06e93384148965cd6dfa26c03ca7345a7f93b74da\n\n (For ppc64le architecture)\n The image digest is sha256:91ffe8aae3a77385414d59688108ce407ea1830fe62e614d150b777414850aab\n\n (For aarch64 architecture)\n The image digest is sha256:30be43aad83a65ed696199caec931c70fe0572b2b977f7fe77069cb57b26d56f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95755"
},
{
"category": "workaround",
"details": "See the security bulletin for a detailed mitigation procedure.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period"
},
{
"cve": "CVE-2026-103111",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-30T04:40:56.869940+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2543797"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact because applications that compile untrusted regular expressions using PCRE2 Just-In-Time (JIT) execution interfaces may allow memory corruption and arbitrary code execution. The risk is primarily confined to specific custom applications or specialized network services that process external regular expressions using vulnerable JIT routines.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-103111"
},
{
"category": "external",
"summary": "RHBZ#2543797",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543797"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-103111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-103111"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m",
"url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m"
}
],
"release_date": "2026-09-30T04:13:59.115000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T12:38:51+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:f38b4b30160584e04166a69480438f34538cb8ad2dbc2db5a0efb0fa34e99af0\n\n (For s390x architecture)\n The image digest is sha256:9a82abfd20b4a0186cf145e06e93384148965cd6dfa26c03ca7345a7f93b74da\n\n (For ppc64le architecture)\n The image digest is sha256:91ffe8aae3a77385414d59688108ce407ea1830fe62e614d150b777414850aab\n\n (For aarch64 architecture)\n The image digest is sha256:30be43aad83a65ed696199caec931c70fe0572b2b977f7fe77069cb57b26d56f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95755"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202611051005-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202611051005-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.