{"metadata": {"count": 297765, "page": 1, "per_page": 100}, "data": [{"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-15T00:31:00+00:00", "cve": "CVE-2026-41178", "id": "CVE-2026-41178", "initial_release_date": "2026-06-04T14:38:23.707000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41178.json", "version": "3", "product_status": {"fixed": 390, "known_affected": 324, "known_not_affected": 1642}, "imported": 1789431966.0, "vulnerability_id": "CVE-2026-41178", "vulnerability_url": "/vuln/CVE-2026-41178"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-15T00:06:38+00:00", "cve": "CVE-2025-61728", "id": "CVE-2025-61728", "initial_release_date": "2025-01-01T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61728.json", "version": "3", "product_status": {"fixed": 7014, "known_affected": 113, "known_not_affected": 4133}, "imported": 1789430798.0, "vulnerability_id": "CVE-2025-61728", "vulnerability_url": "/vuln/CVE-2025-61728"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-15T00:06:11+00:00", "cve": "CVE-2025-58183", "id": "CVE-2025-58183", "initial_release_date": "2025-10-29T22:10:14.376000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang: archive/tar: Unbounded allocation when parsing GNU sparse map", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-58183.json", "version": "3", "product_status": {"fixed": 8922, "known_affected": 131, "known_not_affected": 8348}, "imported": 1789430771.0, "vulnerability_id": "CVE-2025-58183", "vulnerability_url": "/vuln/CVE-2025-58183"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-15T00:04:53+00:00", "cve": "CVE-2026-33186", "id": "CVE-2026-33186", "initial_release_date": "2026-03-20T22:23:32.147000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33186.json", "version": "3", "product_status": {"fixed": 3321, "known_affected": 376, "known_not_affected": 38847}, "imported": 1789430693.0, "vulnerability_id": "CVE-2026-33186", "vulnerability_url": "/vuln/CVE-2026-33186"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-15T00:04:33+00:00", "cve": "CVE-2026-27136", "id": "CVE-2026-27136", "initial_release_date": "2026-05-22T15:01:22.111000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27136.json", "version": "3", "product_status": {"fixed": 1154, "known_affected": 210, "known_not_affected": 8356}, "imported": 1789430673.0, "vulnerability_id": "CVE-2026-27136", "vulnerability_url": "/vuln/CVE-2026-27136"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-15T00:04:21+00:00", "cve": "CVE-2026-25681", "id": "CVE-2026-25681", "initial_release_date": "2026-05-22T15:01:21.975000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25681.json", "version": "3", "product_status": {"fixed": 1156, "known_affected": 276, "known_not_affected": 5956}, "imported": 1789430661.0, "vulnerability_id": "CVE-2026-25681", "vulnerability_url": "/vuln/CVE-2026-25681"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-15T00:04:08+00:00", "cve": "CVE-2025-66506", "id": "CVE-2025-66506", "initial_release_date": "2025-12-04T22:04:41.637000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-66506.json", "version": "3", "product_status": {"fixed": 329, "known_affected": 44, "known_not_affected": 1295}, "imported": 1789430648.0, "vulnerability_id": "CVE-2025-66506", "vulnerability_url": "/vuln/CVE-2025-66506"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-15T00:03:31+00:00", "cve": "CVE-2025-66471", "id": "CVE-2025-66471", "initial_release_date": "2025-12-05T16:06:08.531000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "urllib3: urllib3 Streaming API improperly handles highly compressed data", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-66471.json", "version": "3", "product_status": {"fixed": 1963, "known_affected": 346, "known_not_affected": 3642}, "imported": 1789430611.0, "vulnerability_id": "CVE-2025-66471", "vulnerability_url": "/vuln/CVE-2025-66471"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-15T00:03:24+00:00", "cve": "CVE-2025-66418", "id": "CVE-2025-66418", "initial_release_date": "2025-12-05T16:02:15.271000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-66418.json", "version": "3", "product_status": {"fixed": 1950, "known_affected": 395, "known_not_affected": 2667}, "imported": 1789430604.0, "vulnerability_id": "CVE-2025-66418", "vulnerability_url": "/vuln/CVE-2025-66418"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-15T00:03:10+00:00", "cve": "CVE-2025-64756", "id": "CVE-2025-64756", "initial_release_date": "2025-11-17T17:29:08.029000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "glob: glob: Command Injection Vulnerability via Malicious Filenames", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-64756.json", "version": "3", "product_status": {"fixed": 171, "known_affected": 115, "known_not_affected": 1099}, "imported": 1789430590.0, "vulnerability_id": "CVE-2025-64756", "vulnerability_url": "/vuln/CVE-2025-64756"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-15T00:02:34+00:00", "cve": "CVE-2025-61729", "id": "CVE-2025-61729", "initial_release_date": "2025-12-02T18:54:10.166000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61729.json", "version": "3", "product_status": {"fixed": 8116, "known_affected": 433, "known_not_affected": 5143}, "imported": 1789430554.0, "vulnerability_id": "CVE-2025-61729", "vulnerability_url": "/vuln/CVE-2025-61729"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-15T00:01:58+00:00", "cve": "CVE-2025-61726", "id": "CVE-2025-61726", "initial_release_date": "2025-01-01T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61726.json", "version": "3", "product_status": {"fixed": 10985, "known_affected": 445, "known_not_affected": 17240}, "imported": 1789430518.0, "vulnerability_id": "CVE-2025-61726", "vulnerability_url": "/vuln/CVE-2025-61726"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-15T00:01:46+00:00", "cve": "CVE-2025-52881", "id": "CVE-2025-52881", "initial_release_date": "2025-11-05T09:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-52881.json", "version": "3", "product_status": {"fixed": 2415, "known_affected": 42, "known_not_affected": 4361}, "imported": 1789430506.0, "vulnerability_id": "CVE-2025-52881", "vulnerability_url": "/vuln/CVE-2025-52881"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-15T00:01:22+00:00", "cve": "CVE-2025-30204", "id": "CVE-2025-30204", "initial_release_date": "2025-03-21T21:42:01.382000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-30204.json", "version": "3", "product_status": {"fixed": 3862, "known_affected": 68, "known_not_affected": 11920}, "imported": 1789430482.0, "vulnerability_id": "CVE-2025-30204", "vulnerability_url": "/vuln/CVE-2025-30204"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-15T00:01:17+00:00", "cve": "CVE-2025-22869", "id": "CVE-2025-22869", "initial_release_date": "2025-02-26T03:07:48.855000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22869.json", "version": "3", "product_status": {"fixed": 2839, "known_affected": 53, "known_not_affected": 6263, "under_investigation": 1}, "imported": 1789430477.0, "vulnerability_id": "CVE-2025-22869", "vulnerability_url": "/vuln/CVE-2025-22869"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-15T00:01:05+00:00", "cve": "CVE-2025-22868", "id": "CVE-2025-22868", "initial_release_date": "2025-02-26T03:07:49.012000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22868.json", "version": "3", "product_status": {"fixed": 2199, "known_affected": 93, "known_not_affected": 8426}, "imported": 1789430465.0, "vulnerability_id": "CVE-2025-22868", "vulnerability_url": "/vuln/CVE-2025-22868"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-15T00:01:05+00:00", "cve": "CVE-2025-12816", "id": "CVE-2025-12816", "initial_release_date": "2025-11-25T19:15:50.243000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-12816.json", "version": "3", "product_status": {"fixed": 460, "known_affected": 37, "known_not_affected": 2169}, "imported": 1789430465.0, "vulnerability_id": "CVE-2025-12816", "vulnerability_url": "/vuln/CVE-2025-12816"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-15T00:00:34+00:00", "cve": "CVE-2025-21502", "id": "CVE-2025-21502", "initial_release_date": "2025-01-21T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "openjdk: Enhance array handling (Oracle CPU 2025-01)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21502.json", "version": "3", "product_status": {"fixed": 1653, "known_affected": 116, "known_not_affected": 75}, "imported": 1789430434.0, "vulnerability_id": "CVE-2025-21502", "vulnerability_url": "/vuln/CVE-2025-21502"}, {"meta_source": "redhat_vex", "aggregate_severity": "None", "current_release_date": "2026-09-14T23:57:15+00:00", "cve": "CVE-2023-2004", "id": "CVE-2023-2004", "initial_release_date": "2023-01-01T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "freetype: integer overflowin in tt_hvadvance_adjust() in src/truetype/ttgxvar.c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-2004.json", "version": "3", "product_status": {"fixed": 1, "known_affected": 111, "known_not_affected": 24}, "imported": 1789430235.0, "vulnerability_id": "CVE-2023-2004", "vulnerability_url": "/vuln/CVE-2023-2004"}, {"meta_source": "redhat_vex", "aggregate_severity": "Low", "current_release_date": "2026-09-14T23:57:11+00:00", "cve": "CVE-2023-22045", "id": "CVE-2023-22045", "initial_release_date": "2023-07-18T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: array indexing integer overflow issue (8304468)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-22045.json", "version": "3", "product_status": {"fixed": 2282, "known_affected": 43}, "imported": 1789430231.0, "vulnerability_id": "CVE-2023-22045", "vulnerability_url": "/vuln/CVE-2023-22045"}, {"meta_source": "redhat_vex", "aggregate_severity": "Low", "current_release_date": "2026-09-14T23:57:09+00:00", "cve": "CVE-2023-22006", "id": "CVE-2023-22006", "initial_release_date": "2023-07-18T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: HTTP client insufficient file name validation (8302475)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-22006.json", "version": "3", "product_status": {"fixed": 1531, "known_affected": 2, "known_not_affected": 97}, "imported": 1789430229.0, "vulnerability_id": "CVE-2023-22006", "vulnerability_url": "/vuln/CVE-2023-22006"}, {"meta_source": "redhat_vex", "aggregate_severity": "Low", "current_release_date": "2026-09-14T23:57:05+00:00", "cve": "CVE-2023-21968", "id": "CVE-2023-21968", "initial_release_date": "2023-04-18T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: missing check for slash characters in URI-to-path conversion (8298667)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-21968.json", "version": "3", "product_status": {"fixed": 2401, "known_affected": 49}, "imported": 1789430225.0, "vulnerability_id": "CVE-2023-21968", "vulnerability_url": "/vuln/CVE-2023-21968"}, {"meta_source": "redhat_vex", "aggregate_severity": "Low", "current_release_date": "2026-09-14T23:57:04+00:00", "cve": "CVE-2023-21938", "id": "CVE-2023-21938", "initial_release_date": "2023-04-18T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-21938.json", "version": "3", "product_status": {"fixed": 2401, "known_affected": 49}, "imported": 1789430224.0, "vulnerability_id": "CVE-2023-21938", "vulnerability_url": "/vuln/CVE-2023-21938"}, {"meta_source": "redhat_vex", "aggregate_severity": "Low", "current_release_date": "2026-09-14T23:57:03+00:00", "cve": "CVE-2023-21937", "id": "CVE-2023-21937", "initial_release_date": "2023-04-18T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: missing string checks for NULL characters (8296622)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-21937.json", "version": "3", "product_status": {"fixed": 2401, "known_affected": 49}, "imported": 1789430223.0, "vulnerability_id": "CVE-2023-21937", "vulnerability_url": "/vuln/CVE-2023-21937"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:56:52+00:00", "cve": "CVE-2024-21145", "id": "CVE-2024-21145", "initial_release_date": "2024-07-16T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Out-of-bounds access in 2D image handling (8324559)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-21145.json", "version": "3", "product_status": {"fixed": 2635, "known_affected": 59, "known_not_affected": 24}, "imported": 1789430212.0, "vulnerability_id": "CVE-2024-21145", "vulnerability_url": "/vuln/CVE-2024-21145"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:56:47+00:00", "cve": "CVE-2024-21144", "id": "CVE-2024-21144", "initial_release_date": "2024-07-16T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Pack200 increase loading time due to improper header validation (8322106)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-21144.json", "version": "3", "product_status": {"fixed": 1568, "known_affected": 55, "known_not_affected": 124}, "imported": 1789430207.0, "vulnerability_id": "CVE-2024-21144", "vulnerability_url": "/vuln/CVE-2024-21144"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:56:45+00:00", "cve": "CVE-2024-21140", "id": "CVE-2024-21140", "initial_release_date": "2024-07-16T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-21140.json", "version": "3", "product_status": {"fixed": 2635, "known_affected": 69, "known_not_affected": 14}, "imported": 1789430205.0, "vulnerability_id": "CVE-2024-21140", "vulnerability_url": "/vuln/CVE-2024-21140"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:56:44+00:00", "cve": "CVE-2024-21138", "id": "CVE-2024-21138", "initial_release_date": "2024-07-16T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Excessive symbol length can lead to infinite loop (8319859)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-21138.json", "version": "3", "product_status": {"fixed": 2635, "known_affected": 45, "known_not_affected": 38}, "imported": 1789430204.0, "vulnerability_id": "CVE-2024-21138", "vulnerability_url": "/vuln/CVE-2024-21138"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:56:42+00:00", "cve": "CVE-2024-21131", "id": "CVE-2024-21131", "initial_release_date": "2024-07-16T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: potential UTF8 size overflow (8314794)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-21131.json", "version": "3", "product_status": {"fixed": 2635, "known_affected": 59, "known_not_affected": 24}, "imported": 1789430202.0, "vulnerability_id": "CVE-2024-21131", "vulnerability_url": "/vuln/CVE-2024-21131"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:56:28+00:00", "cve": "CVE-2024-20945", "id": "CVE-2024-20945", "initial_release_date": "2024-01-16T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: logging of digital signature private keys (8316976)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-20945.json", "version": "3", "product_status": {"fixed": 3560, "known_affected": 49}, "imported": 1789430188.0, "vulnerability_id": "CVE-2024-20945", "vulnerability_url": "/vuln/CVE-2024-20945"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:56:24+00:00", "cve": "CVE-2024-20926", "id": "CVE-2024-20926", "initial_release_date": "2024-01-16T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: arbitrary Java code execution in Nashorn (8314284)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-20926.json", "version": "3", "product_status": {"fixed": 2244, "known_affected": 47, "known_not_affected": 100}, "imported": 1789430184.0, "vulnerability_id": "CVE-2024-20926", "vulnerability_url": "/vuln/CVE-2024-20926"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:56:23+00:00", "cve": "CVE-2024-20919", "id": "CVE-2024-20919", "initial_release_date": "2024-01-16T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-20919.json", "version": "3", "product_status": {"fixed": 3500, "known_affected": 43, "known_not_affected": 20}, "imported": 1789430183.0, "vulnerability_id": "CVE-2024-20919", "vulnerability_url": "/vuln/CVE-2024-20919"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:56:23+00:00", "cve": "CVE-2024-20921", "id": "CVE-2024-20921", "initial_release_date": "2024-01-16T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: range check loop optimization issue (8314307)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-20921.json", "version": "3", "product_status": {"fixed": 3560, "known_affected": 49}, "imported": 1789430183.0, "vulnerability_id": "CVE-2024-20921", "vulnerability_url": "/vuln/CVE-2024-20921"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:56:08+00:00", "cve": "CVE-2023-22081", "id": "CVE-2023-22081", "initial_release_date": "2023-10-17T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: certificate path validation issue during client authentication (8309966)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-22081.json", "version": "3", "product_status": {"fixed": 2659, "known_affected": 42, "known_not_affected": 6}, "imported": 1789430168.0, "vulnerability_id": "CVE-2023-22081", "vulnerability_url": "/vuln/CVE-2023-22081"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:55:02+00:00", "cve": "CVE-2025-68121", "id": "CVE-2025-68121", "initial_release_date": "2025-01-01T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68121.json", "version": "3", "product_status": {"fixed": 8088, "known_affected": 186, "known_not_affected": 8506, "under_investigation": 42}, "imported": 1789430102.0, "vulnerability_id": "CVE-2025-68121", "vulnerability_url": "/vuln/CVE-2025-68121"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:54:49+00:00", "cve": "CVE-2023-25193", "id": "CVE-2023-25193", "initial_release_date": "2023-02-04T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-25193.json", "version": "3", "product_status": {"fixed": 1619, "known_affected": 6, "known_not_affected": 119}, "imported": 1789430089.0, "vulnerability_id": "CVE-2023-25193", "vulnerability_url": "/vuln/CVE-2023-25193"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:54:47+00:00", "cve": "CVE-2023-22049", "id": "CVE-2023-22049", "initial_release_date": "2023-07-18T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-22049.json", "version": "3", "product_status": {"fixed": 2342, "known_affected": 49}, "imported": 1789430087.0, "vulnerability_id": "CVE-2023-22049", "vulnerability_url": "/vuln/CVE-2023-22049"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:54:46+00:00", "cve": "CVE-2023-22041", "id": "CVE-2023-22041", "initial_release_date": "2023-07-18T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: weakness in AES implementation (8308682)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-22041.json", "version": "3", "product_status": {"fixed": 1531, "known_affected": 2, "known_not_affected": 97}, "imported": 1789430086.0, "vulnerability_id": "CVE-2023-22041", "vulnerability_url": "/vuln/CVE-2023-22041"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:54:45+00:00", "cve": "CVE-2023-22036", "id": "CVE-2023-22036", "initial_release_date": "2023-07-18T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: ZIP file parsing infinite loop (8302483)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-22036.json", "version": "3", "product_status": {"fixed": 1531, "known_affected": 2, "known_not_affected": 97}, "imported": 1789430085.0, "vulnerability_id": "CVE-2023-22036", "vulnerability_url": "/vuln/CVE-2023-22036"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:54:32+00:00", "cve": "CVE-2023-21967", "id": "CVE-2023-21967", "initial_release_date": "2023-04-18T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: certificate validation issue in TLS session negotiation (8298310)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-21967.json", "version": "3", "product_status": {"fixed": 2401, "known_affected": 49}, "imported": 1789430072.0, "vulnerability_id": "CVE-2023-21967", "vulnerability_url": "/vuln/CVE-2023-21967"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:54:30+00:00", "cve": "CVE-2023-21954", "id": "CVE-2023-21954", "initial_release_date": "2023-04-18T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: incorrect enqueue of references in garbage collector (8298191)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-21954.json", "version": "3", "product_status": {"fixed": 2341, "known_affected": 43}, "imported": 1789430070.0, "vulnerability_id": "CVE-2023-21954", "vulnerability_url": "/vuln/CVE-2023-21954"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:54:29+00:00", "cve": "CVE-2023-21939", "id": "CVE-2023-21939", "initial_release_date": "2023-04-18T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Swing HTML parsing issue (8296832)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-21939.json", "version": "3", "product_status": {"fixed": 2401, "known_affected": 49}, "imported": 1789430069.0, "vulnerability_id": "CVE-2023-21939", "vulnerability_url": "/vuln/CVE-2023-21939"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:54:18+00:00", "cve": "CVE-2022-21541", "id": "CVE-2022-21541", "initial_release_date": "2022-07-19T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21541.json", "version": "3", "product_status": {"fixed": 1420, "known_affected": 39}, "imported": 1789430058.0, "vulnerability_id": "CVE-2022-21541", "vulnerability_url": "/vuln/CVE-2022-21541"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:54:18+00:00", "cve": "CVE-2022-21540", "id": "CVE-2022-21540", "initial_release_date": "2022-07-19T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: class compilation issue (Hotspot, 8281859)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21540.json", "version": "3", "product_status": {"fixed": 1420, "known_affected": 39}, "imported": 1789430058.0, "vulnerability_id": "CVE-2022-21540", "vulnerability_url": "/vuln/CVE-2022-21540"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:54:07+00:00", "cve": "CVE-2022-21496", "id": "CVE-2022-21496", "initial_release_date": "2022-04-19T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: URI parsing inconsistencies (JNDI, 8278972)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21496.json", "version": "3", "product_status": {"fixed": 1451, "known_affected": 40}, "imported": 1789430047.0, "vulnerability_id": "CVE-2022-21496", "vulnerability_url": "/vuln/CVE-2022-21496"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:54:05+00:00", "cve": "CVE-2022-21443", "id": "CVE-2022-21443", "initial_release_date": "2022-04-19T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8275151)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21443.json", "version": "3", "product_status": {"fixed": 1451, "known_affected": 40}, "imported": 1789430045.0, "vulnerability_id": "CVE-2022-21443", "vulnerability_url": "/vuln/CVE-2022-21443"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:54:03+00:00", "cve": "CVE-2022-21434", "id": "CVE-2022-21434", "initial_release_date": "2022-04-19T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21434.json", "version": "3", "product_status": {"fixed": 1451, "known_affected": 40}, "imported": 1789430043.0, "vulnerability_id": "CVE-2022-21434", "vulnerability_url": "/vuln/CVE-2022-21434"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:54:02+00:00", "cve": "CVE-2022-21426", "id": "CVE-2022-21426", "initial_release_date": "2022-04-19T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21426.json", "version": "3", "product_status": {"fixed": 1392, "known_affected": 54}, "imported": 1789430042.0, "vulnerability_id": "CVE-2022-21426", "vulnerability_url": "/vuln/CVE-2022-21426"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:51+00:00", "cve": "CVE-2022-21366", "id": "CVE-2022-21366", "initial_release_date": "2022-01-18T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Excessive memory allocation in TIFF*Decompressor (ImageIO, 8274096)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21366.json", "version": "3", "product_status": {"fixed": 616, "known_not_affected": 79}, "imported": 1789430031.0, "vulnerability_id": "CVE-2022-21366", "vulnerability_url": "/vuln/CVE-2022-21366"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:49+00:00", "cve": "CVE-2022-21365", "id": "CVE-2022-21365", "initial_release_date": "2022-01-18T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Integer overflow in BMPImageReader (ImageIO, 8273838)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21365.json", "version": "3", "product_status": {"fixed": 1127, "known_affected": 39}, "imported": 1789430029.0, "vulnerability_id": "CVE-2022-21365", "vulnerability_url": "/vuln/CVE-2022-21365"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:46+00:00", "cve": "CVE-2022-21360", "id": "CVE-2022-21360", "initial_release_date": "2022-01-18T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8273756)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21360.json", "version": "3", "product_status": {"fixed": 1127, "known_affected": 39}, "imported": 1789430026.0, "vulnerability_id": "CVE-2022-21360", "vulnerability_url": "/vuln/CVE-2022-21360"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:45+00:00", "cve": "CVE-2022-21341", "id": "CVE-2022-21341", "initial_release_date": "2022-01-18T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Insufficient checks when deserializing exceptions in ObjectInputStream (Serialization, 8272236)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21341.json", "version": "3", "product_status": {"fixed": 1127, "known_affected": 39}, "imported": 1789430025.0, "vulnerability_id": "CVE-2022-21341", "vulnerability_url": "/vuln/CVE-2022-21341"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:41+00:00", "cve": "CVE-2022-21340", "id": "CVE-2022-21340", "initial_release_date": "2022-01-18T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Excessive resource use when reading JAR manifest attributes (Libraries, 8272026)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21340.json", "version": "3", "product_status": {"fixed": 1127, "known_affected": 39}, "imported": 1789430021.0, "vulnerability_id": "CVE-2022-21340", "vulnerability_url": "/vuln/CVE-2022-21340"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:40+00:00", "cve": "CVE-2022-21305", "id": "CVE-2022-21305", "initial_release_date": "2022-01-18T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Array indexing issues in LIRGenerator (Hotspot, 8272014)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21305.json", "version": "3", "product_status": {"fixed": 1030, "known_affected": 39}, "imported": 1789430020.0, "vulnerability_id": "CVE-2022-21305", "vulnerability_url": "/vuln/CVE-2022-21305"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:36+00:00", "cve": "CVE-2022-21299", "id": "CVE-2022-21299", "initial_release_date": "2022-01-18T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21299.json", "version": "3", "product_status": {"fixed": 1072, "known_affected": 53, "known_not_affected": 228}, "imported": 1789430016.0, "vulnerability_id": "CVE-2022-21299", "vulnerability_url": "/vuln/CVE-2022-21299"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:34+00:00", "cve": "CVE-2022-21296", "id": "CVE-2022-21296", "initial_release_date": "2022-01-18T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Incorrect access checks in XMLEntityManager (JAXP, 8270498)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21296.json", "version": "3", "product_status": {"fixed": 1030, "known_affected": 40}, "imported": 1789430014.0, "vulnerability_id": "CVE-2022-21296", "vulnerability_url": "/vuln/CVE-2022-21296"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:30+00:00", "cve": "CVE-2022-21293", "id": "CVE-2022-21293", "initial_release_date": "2022-01-18T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Incomplete checks of StringBuffer and StringBuilder during deserialization (Libraries, 8270392)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21293.json", "version": "3", "product_status": {"fixed": 1127, "known_affected": 39}, "imported": 1789430010.0, "vulnerability_id": "CVE-2022-21293", "vulnerability_url": "/vuln/CVE-2022-21293"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:30+00:00", "cve": "CVE-2022-21294", "id": "CVE-2022-21294", "initial_release_date": "2022-01-18T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Incorrect IdentityHashMap size checks during deserialization (Libraries, 8270416)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21294.json", "version": "3", "product_status": {"fixed": 1127, "known_affected": 39}, "imported": 1789430010.0, "vulnerability_id": "CVE-2022-21294", "vulnerability_url": "/vuln/CVE-2022-21294"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:28+00:00", "cve": "CVE-2022-21291", "id": "CVE-2022-21291", "initial_release_date": "2022-01-18T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Incorrect marking of writeable fields (Hotspot, 8270386)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21291.json", "version": "3", "product_status": {"fixed": 616, "known_not_affected": 79}, "imported": 1789430008.0, "vulnerability_id": "CVE-2022-21291", "vulnerability_url": "/vuln/CVE-2022-21291"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:24+00:00", "cve": "CVE-2022-21283", "id": "CVE-2022-21283", "initial_release_date": "2022-01-18T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Unexpected exception thrown in regex Pattern (Libraries, 8268813)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21283.json", "version": "3", "product_status": {"fixed": 1030, "known_affected": 39}, "imported": 1789430004.0, "vulnerability_id": "CVE-2022-21283", "vulnerability_url": "/vuln/CVE-2022-21283"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:23+00:00", "cve": "CVE-2022-21282", "id": "CVE-2022-21282", "initial_release_date": "2022-01-18T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Insufficient URI checks in the XSLT TransformerImpl (JAXP, 8270492)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21282.json", "version": "3", "product_status": {"fixed": 1030, "known_affected": 39}, "imported": 1789430003.0, "vulnerability_id": "CVE-2022-21282", "vulnerability_url": "/vuln/CVE-2022-21282"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:19+00:00", "cve": "CVE-2022-21277", "id": "CVE-2022-21277", "initial_release_date": "2022-01-18T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Incorrect reading of TIFF files in TIFFNullDecompressor (ImageIO, 8270952)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21277.json", "version": "3", "product_status": {"fixed": 616, "known_not_affected": 79}, "imported": 1789429999.0, "vulnerability_id": "CVE-2022-21277", "vulnerability_url": "/vuln/CVE-2022-21277"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:17+00:00", "cve": "CVE-2026-70457", "id": "CVE-2026-70457", "initial_release_date": "2026-08-13T14:44:30.104000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync: Memory corruption via out-of-bounds write in size parsing", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70457.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 1, "known_not_affected": 8}, "imported": 1789429997.0, "vulnerability_id": "CVE-2026-70457", "vulnerability_url": "/vuln/CVE-2026-70457"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:17+00:00", "cve": "CVE-2022-21248", "id": "CVE-2022-21248", "initial_release_date": "2022-01-18T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Incomplete deserialization class filtering in ObjectInputStream (Serialization, 8264934)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21248.json", "version": "3", "product_status": {"fixed": 1127, "known_affected": 39}, "imported": 1789429997.0, "vulnerability_id": "CVE-2022-21248", "vulnerability_url": "/vuln/CVE-2022-21248"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:11+00:00", "cve": "CVE-2026-53789", "id": "CVE-2026-53789", "initial_release_date": "2026-08-13T14:37:14.035000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync: Arbitrary file deletion via malicious file list", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53789.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 9}, "imported": 1789429991.0, "vulnerability_id": "CVE-2026-53789", "vulnerability_url": "/vuln/CVE-2026-53789"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:10+00:00", "cve": "CVE-2026-70454", "id": "CVE-2026-70454", "initial_release_date": "2026-08-13T14:45:39.599000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70454.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 1, "known_not_affected": 8}, "imported": 1789429990.0, "vulnerability_id": "CVE-2026-70454", "vulnerability_url": "/vuln/CVE-2026-70454"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:53:09+00:00", "cve": "CVE-2026-70453", "id": "CVE-2026-70453", "initial_release_date": "2026-08-13T14:46:20.696000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync: Denial of Service via Algorithmic Complexity", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70453.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 9}, "imported": 1789429989.0, "vulnerability_id": "CVE-2026-70453", "vulnerability_url": "/vuln/CVE-2026-70453"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:52:15+00:00", "cve": "CVE-2024-21147", "id": "CVE-2024-21147", "initial_release_date": "2024-07-16T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: RangeCheckElimination array index overflow (8323231)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-21147.json", "version": "3", "product_status": {"fixed": 2635, "known_affected": 31, "known_not_affected": 52}, "imported": 1789429935.0, "vulnerability_id": "CVE-2024-21147", "vulnerability_url": "/vuln/CVE-2024-21147"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:48:45+00:00", "cve": "CVE-2024-24786", "id": "CVE-2024-24786", "initial_release_date": "2024-03-05T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-24786.json", "version": "3", "product_status": {"fixed": 2152, "known_affected": 112, "known_not_affected": 11937, "under_investigation": 57}, "imported": 1789429725.0, "vulnerability_id": "CVE-2024-24786", "vulnerability_url": "/vuln/CVE-2024-24786"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:48:43+00:00", "cve": "CVE-2022-30631", "id": "CVE-2022-30631", "initial_release_date": "2022-07-12T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang: compress/gzip: stack exhaustion in Reader.Read", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-30631.json", "version": "3", "product_status": {"fixed": 4253, "known_affected": 91, "known_not_affected": 2159}, "imported": 1789429723.0, "vulnerability_id": "CVE-2022-30631", "vulnerability_url": "/vuln/CVE-2022-30631"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:48:34+00:00", "cve": "CVE-2024-20952", "id": "CVE-2024-20952", "initial_release_date": "2024-01-16T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-20952.json", "version": "3", "product_status": {"fixed": 3560, "known_affected": 49}, "imported": 1789429714.0, "vulnerability_id": "CVE-2024-20952", "vulnerability_url": "/vuln/CVE-2024-20952"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:48:34+00:00", "cve": "CVE-2024-20918", "id": "CVE-2024-20918", "initial_release_date": "2024-01-16T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-20918.json", "version": "3", "product_status": {"fixed": 3560, "known_affected": 29, "known_not_affected": 20}, "imported": 1789429714.0, "vulnerability_id": "CVE-2024-20918", "vulnerability_url": "/vuln/CVE-2024-20918"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:45:02+00:00", "cve": "CVE-2026-32280", "id": "CVE-2026-32280", "initial_release_date": "2026-04-08T01:06:58.595000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json", "version": "3", "product_status": {"fixed": 4339, "known_affected": 132, "known_not_affected": 6798}, "imported": 1789429502.0, "vulnerability_id": "CVE-2026-32280", "vulnerability_url": "/vuln/CVE-2026-32280"}, {"meta_source": "redhat_vex", "aggregate_severity": "Moderate", "current_release_date": "2026-09-14T23:44:31+00:00", "cve": "CVE-2021-20329", "id": "CVE-2021-20329", "initial_release_date": "2021-03-30T00:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "mongo-go-driver: specific cstrings input may not be properly validated", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-20329.json", "version": "3", "product_status": {"fixed": 252, "known_affected": 69, "known_not_affected": 3782}, "imported": 1789429471.0, "vulnerability_id": "CVE-2021-20329", "vulnerability_url": "/vuln/CVE-2021-20329"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:44:10+00:00", "cve": "CVE-2023-21930", "id": "CVE-2023-21930", "initial_release_date": "2023-04-18T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: improper connection handling during TLS handshake (8294474)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-21930.json", "version": "3", "product_status": {"fixed": 2401, "known_affected": 49}, "imported": 1789429450.0, "vulnerability_id": "CVE-2023-21930", "vulnerability_url": "/vuln/CVE-2023-21930"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:44:05+00:00", "cve": "CVE-2022-34169", "id": "CVE-2022-34169", "initial_release_date": "2022-07-19T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-34169.json", "version": "3", "product_status": {"fixed": 1862, "known_affected": 48, "known_not_affected": 27}, "imported": 1789429445.0, "vulnerability_id": "CVE-2022-34169", "vulnerability_url": "/vuln/CVE-2022-34169"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:43:59+00:00", "cve": "CVE-2022-21476", "id": "CVE-2022-21476", "initial_release_date": "2022-04-19T20:00:00+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008)", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21476.json", "version": "3", "product_status": {"fixed": 1354, "known_affected": 40, "known_not_affected": 20}, "imported": 1789429439.0, "vulnerability_id": "CVE-2022-21476", "vulnerability_url": "/vuln/CVE-2022-21476"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:43:54+00:00", "cve": "CVE-2026-33811", "id": "CVE-2026-33811", "initial_release_date": "2026-05-07T19:41:19.285000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json", "version": "3", "product_status": {"fixed": 1775, "known_affected": 137, "known_not_affected": 7970}, "imported": 1789429434.0, "vulnerability_id": "CVE-2026-33811", "vulnerability_url": "/vuln/CVE-2026-33811"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:43:48+00:00", "cve": "CVE-2026-70455", "id": "CVE-2026-70455", "initial_release_date": "2026-08-13T14:45:11.164000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync: Denial of Service via Zstandard compression thread exhaustion", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70455.json", "version": "3", "product_status": {"fixed": 15, "known_not_affected": 13}, "imported": 1789429428.0, "vulnerability_id": "CVE-2026-70455", "vulnerability_url": "/vuln/CVE-2026-70455"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:43:46+00:00", "cve": "CVE-2026-53784", "id": "CVE-2026-53784", "initial_release_date": "2026-08-13T14:34:22.543000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync: Unauthorized File Access via Symlink Module Root", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53784.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 9}, "imported": 1789429426.0, "vulnerability_id": "CVE-2026-53784", "vulnerability_url": "/vuln/CVE-2026-53784"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:43:44+00:00", "cve": "CVE-2026-53783", "id": "CVE-2026-53783", "initial_release_date": "2026-08-13T14:34:07.144000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync: Directory escape via TOCTOU race condition in rrsync", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53783.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 7, "known_not_affected": 2}, "imported": 1789429424.0, "vulnerability_id": "CVE-2026-53783", "vulnerability_url": "/vuln/CVE-2026-53783"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:43:39+00:00", "cve": "CVE-2026-70464", "id": "CVE-2026-70464", "initial_release_date": "2026-08-13T14:41:47.987000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync: Denial of Service via handshake stall", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70464.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 9}, "imported": 1789429419.0, "vulnerability_id": "CVE-2026-70464", "vulnerability_url": "/vuln/CVE-2026-70464"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:43:36+00:00", "cve": "CVE-2026-70463", "id": "CVE-2026-70463", "initial_release_date": "2026-08-13T14:42:07.126000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync: Authorization bypass via `auth users` directive parsing", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70463.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 7, "known_not_affected": 2}, "imported": 1789429416.0, "vulnerability_id": "CVE-2026-70463", "vulnerability_url": "/vuln/CVE-2026-70463"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:43:34+00:00", "cve": "CVE-2026-70461", "id": "CVE-2026-70461", "initial_release_date": "2026-08-13T14:42:49.726000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync: Information disclosure and denial of service via crafted files-from entry", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70461.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 7, "known_not_affected": 2}, "imported": 1789429414.0, "vulnerability_id": "CVE-2026-70461", "vulnerability_url": "/vuln/CVE-2026-70461"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:43:29+00:00", "cve": "CVE-2026-70460", "id": "CVE-2026-70460", "initial_release_date": "2026-08-13T14:43:06.250000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70460.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 9}, "imported": 1789429409.0, "vulnerability_id": "CVE-2026-70460", "vulnerability_url": "/vuln/CVE-2026-70460"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:43:26+00:00", "cve": "CVE-2026-70458", "id": "CVE-2026-70458", "initial_release_date": "2026-08-13T14:44:06.034000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync: Memory corruption via crafted file entries", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70458.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 9}, "imported": 1789429406.0, "vulnerability_id": "CVE-2026-70458", "vulnerability_url": "/vuln/CVE-2026-70458"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:43:20+00:00", "cve": "CVE-2026-70456", "id": "CVE-2026-70456", "initial_release_date": "2026-08-13T14:44:56.646000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync: Heap Out-of-Bounds Write via crafted argument list", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70456.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 9}, "imported": 1789429400.0, "vulnerability_id": "CVE-2026-70456", "vulnerability_url": "/vuln/CVE-2026-70456"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:43:18+00:00", "cve": "CVE-2026-70452", "id": "CVE-2026-70452", "initial_release_date": "2026-08-13T14:46:50.541000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70452.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 7, "known_not_affected": 2}, "imported": 1789429398.0, "vulnerability_id": "CVE-2026-70452", "vulnerability_url": "/vuln/CVE-2026-70452"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:43:08+00:00", "cve": "CVE-2026-53803", "id": "CVE-2026-53803", "initial_release_date": "2026-08-13T14:33:18.552000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync: Local Privilege Escalation via Symlink Following", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53803.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 9}, "imported": 1789429388.0, "vulnerability_id": "CVE-2026-53803", "vulnerability_url": "/vuln/CVE-2026-53803"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:42:59+00:00", "cve": "CVE-2026-53802", "id": "CVE-2026-53802", "initial_release_date": "2026-08-13T14:32:26.170000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync: Arbitrary File Read via Symlink Following", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53802.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 9}, "imported": 1789429379.0, "vulnerability_id": "CVE-2026-53802", "vulnerability_url": "/vuln/CVE-2026-53802"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:42:49+00:00", "cve": "CVE-2026-53795", "id": "CVE-2026-53795", "initial_release_date": "2026-08-13T14:39:26.044000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53795.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 9}, "imported": 1789429369.0, "vulnerability_id": "CVE-2026-53795", "vulnerability_url": "/vuln/CVE-2026-53795"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:42:41+00:00", "cve": "CVE-2026-53793", "id": "CVE-2026-53793", "initial_release_date": "2026-08-13T14:38:42.288000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53793.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 9}, "imported": 1789429361.0, "vulnerability_id": "CVE-2026-53793", "vulnerability_url": "/vuln/CVE-2026-53793"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:42:31+00:00", "cve": "CVE-2026-53791", "id": "CVE-2026-53791", "initial_release_date": "2026-08-13T14:38:10.300000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53791.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 1, "known_not_affected": 8}, "imported": 1789429351.0, "vulnerability_id": "CVE-2026-53791", "vulnerability_url": "/vuln/CVE-2026-53791"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:42:24+00:00", "cve": "CVE-2026-53790", "id": "CVE-2026-53790", "initial_release_date": "2026-08-13T14:37:41.052000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53790.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 9}, "imported": 1789429344.0, "vulnerability_id": "CVE-2026-53790", "vulnerability_url": "/vuln/CVE-2026-53790"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:42:13+00:00", "cve": "CVE-2026-53785", "id": "CVE-2026-53785", "initial_release_date": "2026-08-13T14:34:59.757000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "rsync: rsync: Arbitrary file write via path traversal in --relative mode", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53785.json", "version": "3", "product_status": {"fixed": 30, "known_affected": 9}, "imported": 1789429333.0, "vulnerability_id": "CVE-2026-53785", "vulnerability_url": "/vuln/CVE-2026-53785"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:40:32+00:00", "cve": "CVE-2026-39830", "id": "CVE-2026-39830", "initial_release_date": "2026-05-22T02:31:27.208000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json", "version": "3", "product_status": {"fixed": 1054, "known_affected": 118, "known_not_affected": 2418}, "imported": 1789429232.0, "vulnerability_id": "CVE-2026-39830", "vulnerability_url": "/vuln/CVE-2026-39830"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:40:14+00:00", "cve": "CVE-2026-39829", "id": "CVE-2026-39829", "initial_release_date": "2026-05-22T02:31:27.324000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json", "version": "3", "product_status": {"fixed": 1164, "known_affected": 106, "known_not_affected": 6777}, "imported": 1789429214.0, "vulnerability_id": "CVE-2026-39829", "vulnerability_url": "/vuln/CVE-2026-39829"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:40:03+00:00", "cve": "CVE-2026-56862", "id": "CVE-2026-56862", "initial_release_date": "2026-08-13T21:58:53.216000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56862.json", "version": "3", "product_status": {"fixed": 1369, "known_affected": 352, "known_not_affected": 473}, "imported": 1789429203.0, "vulnerability_id": "CVE-2026-56862", "vulnerability_url": "/vuln/CVE-2026-56862"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:39:16+00:00", "cve": "CVE-2026-39835", "id": "CVE-2026-39835", "initial_release_date": "2026-05-22T02:31:26.982000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json", "version": "3", "product_status": {"fixed": 897, "known_affected": 89, "known_not_affected": 2867}, "imported": 1789429156.0, "vulnerability_id": "CVE-2026-39835", "vulnerability_url": "/vuln/CVE-2026-39835"}, {"meta_source": "redhat_vex", "aggregate_severity": "Important", "current_release_date": "2026-09-14T23:37:47+00:00", "cve": "CVE-2026-34986", "id": "CVE-2026-34986", "initial_release_date": "2026-04-06T16:22:45.353000+00:00", "source": "Red Hat CSAF VEX", "status": "final", "title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34986.json", "version": "3", "product_status": {"fixed": 2835, "known_affected": 152, "known_not_affected": 15951}, "imported": 1789429067.0, "vulnerability_id": "CVE-2026-34986", "vulnerability_url": "/vuln/CVE-2026-34986"}]}