{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for python3.14-urllib3 is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)\n\n* urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:27929",
        "url": "https://access.redhat.com/errata/RHSA-2026:27929"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2477154",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
      },
      {
        "category": "external",
        "summary": "2477167",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
      },
      {
        "category": "external",
        "summary": "RHEL-184903",
        "url": "https://issues.redhat.com/browse/RHEL-184903"
      },
      {
        "category": "external",
        "summary": "RHEL-185128",
        "url": "https://issues.redhat.com/browse/RHEL-185128"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27929.json"
      }
    ],
    "title": "Red Hat Security Advisory: python3.14-urllib3 security update",
    "tracking": {
      "current_release_date": "2026-07-09T21:15:23+00:00",
      "generator": {
        "date": "2026-07-09T21:15:23+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.2"
        }
      },
      "id": "RHSA-2026:27929",
      "initial_release_date": "2026-06-22T14:50:02+00:00",
      "revision_history": [
        {
          "date": "2026-06-22T14:50:02+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-22T14:50:02+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-09T21:15:23+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                  "product_id": "AppStream-10.2.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3.14-urllib3-0:2.6.3-2.el10_2.noarch",
                "product": {
                  "name": "python3.14-urllib3-0:2.6.3-2.el10_2.noarch",
                  "product_id": "python3.14-urllib3-0:2.6.3-2.el10_2.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.14-urllib3@2.6.3-2.el10_2?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3.14-urllib3-0:2.6.3-2.el10_2.src",
                "product": {
                  "name": "python3.14-urllib3-0:2.6.3-2.el10_2.src",
                  "product_id": "python3.14-urllib3-0:2.6.3-2.el10_2.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.14-urllib3@2.6.3-2.el10_2?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.14-urllib3-0:2.6.3-2.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:python3.14-urllib3-0:2.6.3-2.el10_2.noarch"
        },
        "product_reference": "python3.14-urllib3-0:2.6.3-2.el10_2.noarch",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.14-urllib3-0:2.6.3-2.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:python3.14-urllib3-0:2.6.3-2.el10_2.src"
        },
        "product_reference": "python3.14-urllib3-0:2.6.3-2.el10_2.src",
        "relates_to_product_reference": "AppStream-10.2.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-44431",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-05-13T17:01:41.663622+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477167"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:python3.14-urllib3-0:2.6.3-2.el10_2.noarch",
          "AppStream-10.2.Z:python3.14-urllib3-0:2.6.3-2.el10_2.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477167",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44431",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
        }
      ],
      "release_date": "2026-05-13T15:20:24.588000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T14:50:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:python3.14-urllib3-0:2.6.3-2.el10_2.noarch",
            "AppStream-10.2.Z:python3.14-urllib3-0:2.6.3-2.el10_2.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:27929"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:python3.14-urllib3-0:2.6.3-2.el10_2.noarch",
            "AppStream-10.2.Z:python3.14-urllib3-0:2.6.3-2.el10_2.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
    },
    {
      "cve": "CVE-2026-44432",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-05-13T17:01:01.083841+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:python3.14-urllib3-0:2.6.3-2.el10_2.noarch",
          "AppStream-10.2.Z:python3.14-urllib3-0:2.6.3-2.el10_2.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
        }
      ],
      "release_date": "2026-05-13T15:17:12.611000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T14:50:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:python3.14-urllib3-0:2.6.3-2.el10_2.noarch",
            "AppStream-10.2.Z:python3.14-urllib3-0:2.6.3-2.el10_2.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:27929"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:python3.14-urllib3-0:2.6.3-2.el10_2.noarch",
            "AppStream-10.2.Z:python3.14-urllib3-0:2.6.3-2.el10_2.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for python-urllib3 is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)\n\n* urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:28000",
        "url": "https://access.redhat.com/errata/RHSA-2026:28000"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2477154",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
      },
      {
        "category": "external",
        "summary": "2477167",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
      },
      {
        "category": "external",
        "summary": "RHEL-184817",
        "url": "https://issues.redhat.com/browse/RHEL-184817"
      },
      {
        "category": "external",
        "summary": "RHEL-185121",
        "url": "https://issues.redhat.com/browse/RHEL-185121"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28000.json"
      }
    ],
    "title": "Red Hat Security Advisory: python-urllib3 security update",
    "tracking": {
      "current_release_date": "2026-07-09T21:15:23+00:00",
      "generator": {
        "date": "2026-07-09T21:15:23+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.2"
        }
      },
      "id": "RHSA-2026:28000",
      "initial_release_date": "2026-06-22T16:14:02+00:00",
      "revision_history": [
        {
          "date": "2026-06-22T16:14:02+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-22T16:14:02+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-09T21:15:23+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 10)",
                  "product_id": "BaseOS-10.2.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-urllib3-0:1.26.19-4.el10_2.src",
                "product": {
                  "name": "python-urllib3-0:1.26.19-4.el10_2.src",
                  "product_id": "python-urllib3-0:1.26.19-4.el10_2.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-urllib3@1.26.19-4.el10_2?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-urllib3-0:1.26.19-4.el10_2.noarch",
                "product": {
                  "name": "python3-urllib3-0:1.26.19-4.el10_2.noarch",
                  "product_id": "python3-urllib3-0:1.26.19-4.el10_2.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-urllib3@1.26.19-4.el10_2?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-urllib3-0:1.26.19-4.el10_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:python-urllib3-0:1.26.19-4.el10_2.src"
        },
        "product_reference": "python-urllib3-0:1.26.19-4.el10_2.src",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-urllib3-0:1.26.19-4.el10_2.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:python3-urllib3-0:1.26.19-4.el10_2.noarch"
        },
        "product_reference": "python3-urllib3-0:1.26.19-4.el10_2.noarch",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-44431",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-05-13T17:01:41.663622+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477167"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-10.2.Z:python-urllib3-0:1.26.19-4.el10_2.src",
          "BaseOS-10.2.Z:python3-urllib3-0:1.26.19-4.el10_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477167",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44431",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
        }
      ],
      "release_date": "2026-05-13T15:20:24.588000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T16:14:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-10.2.Z:python-urllib3-0:1.26.19-4.el10_2.src",
            "BaseOS-10.2.Z:python3-urllib3-0:1.26.19-4.el10_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:28000"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-10.2.Z:python-urllib3-0:1.26.19-4.el10_2.src",
            "BaseOS-10.2.Z:python3-urllib3-0:1.26.19-4.el10_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
    },
    {
      "cve": "CVE-2026-44432",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-05-13T17:01:01.083841+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-10.2.Z:python-urllib3-0:1.26.19-4.el10_2.src",
          "BaseOS-10.2.Z:python3-urllib3-0:1.26.19-4.el10_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
        }
      ],
      "release_date": "2026-05-13T15:17:12.611000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T16:14:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-10.2.Z:python-urllib3-0:1.26.19-4.el10_2.src",
            "BaseOS-10.2.Z:python3-urllib3-0:1.26.19-4.el10_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:28000"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-10.2.Z:python-urllib3-0:1.26.19-4.el10_2.src",
            "BaseOS-10.2.Z:python3-urllib3-0:1.26.19-4.el10_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for python3.14-urllib3 is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)\n\n* urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:28157",
        "url": "https://access.redhat.com/errata/RHSA-2026:28157"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2477154",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
      },
      {
        "category": "external",
        "summary": "2477167",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
      },
      {
        "category": "external",
        "summary": "RHEL-184902",
        "url": "https://issues.redhat.com/browse/RHEL-184902"
      },
      {
        "category": "external",
        "summary": "RHEL-185127",
        "url": "https://issues.redhat.com/browse/RHEL-185127"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28157.json"
      }
    ],
    "title": "Red Hat Security Advisory: python3.14-urllib3 security update",
    "tracking": {
      "current_release_date": "2026-07-09T21:15:23+00:00",
      "generator": {
        "date": "2026-07-09T21:15:23+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.2"
        }
      },
      "id": "RHSA-2026:28157",
      "initial_release_date": "2026-06-23T10:55:47+00:00",
      "revision_history": [
        {
          "date": "2026-06-23T10:55:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-23T10:55:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-09T21:15:23+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3.14-urllib3-0:2.6.3-2.el9_8.noarch",
                "product": {
                  "name": "python3.14-urllib3-0:2.6.3-2.el9_8.noarch",
                  "product_id": "python3.14-urllib3-0:2.6.3-2.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.14-urllib3@2.6.3-2.el9_8?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3.14-urllib3-0:2.6.3-2.el9_8.src",
                "product": {
                  "name": "python3.14-urllib3-0:2.6.3-2.el9_8.src",
                  "product_id": "python3.14-urllib3-0:2.6.3-2.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.14-urllib3@2.6.3-2.el9_8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.14-urllib3-0:2.6.3-2.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:python3.14-urllib3-0:2.6.3-2.el9_8.noarch"
        },
        "product_reference": "python3.14-urllib3-0:2.6.3-2.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.14-urllib3-0:2.6.3-2.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:python3.14-urllib3-0:2.6.3-2.el9_8.src"
        },
        "product_reference": "python3.14-urllib3-0:2.6.3-2.el9_8.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-44431",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-05-13T17:01:41.663622+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477167"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:python3.14-urllib3-0:2.6.3-2.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:python3.14-urllib3-0:2.6.3-2.el9_8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477167",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44431",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
        }
      ],
      "release_date": "2026-05-13T15:20:24.588000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-23T10:55:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:python3.14-urllib3-0:2.6.3-2.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:python3.14-urllib3-0:2.6.3-2.el9_8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:28157"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:python3.14-urllib3-0:2.6.3-2.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:python3.14-urllib3-0:2.6.3-2.el9_8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
    },
    {
      "cve": "CVE-2026-44432",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-05-13T17:01:01.083841+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:python3.14-urllib3-0:2.6.3-2.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:python3.14-urllib3-0:2.6.3-2.el9_8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
        }
      ],
      "release_date": "2026-05-13T15:17:12.611000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-23T10:55:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:python3.14-urllib3-0:2.6.3-2.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:python3.14-urllib3-0:2.6.3-2.el9_8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:28157"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:python3.14-urllib3-0:2.6.3-2.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:python3.14-urllib3-0:2.6.3-2.el9_8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for python-urllib3 is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)\n\n* urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:28158",
        "url": "https://access.redhat.com/errata/RHSA-2026:28158"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2477154",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
      },
      {
        "category": "external",
        "summary": "2477167",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
      },
      {
        "category": "external",
        "summary": "RHEL-184816",
        "url": "https://issues.redhat.com/browse/RHEL-184816"
      },
      {
        "category": "external",
        "summary": "RHEL-185123",
        "url": "https://issues.redhat.com/browse/RHEL-185123"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28158.json"
      }
    ],
    "title": "Red Hat Security Advisory: python-urllib3 security update",
    "tracking": {
      "current_release_date": "2026-07-09T21:15:24+00:00",
      "generator": {
        "date": "2026-07-09T21:15:24+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.2"
        }
      },
      "id": "RHSA-2026:28158",
      "initial_release_date": "2026-06-23T10:47:47+00:00",
      "revision_history": [
        {
          "date": "2026-06-23T10:47:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-23T10:47:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-09T21:15:24+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 9)",
                  "product_id": "BaseOS-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:9::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-urllib3-0:1.26.5-8.el9_8.src",
                "product": {
                  "name": "python-urllib3-0:1.26.5-8.el9_8.src",
                  "product_id": "python-urllib3-0:1.26.5-8.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-urllib3@1.26.5-8.el9_8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-urllib3-0:1.26.5-8.el9_8.noarch",
                "product": {
                  "name": "python3-urllib3-0:1.26.5-8.el9_8.noarch",
                  "product_id": "python3-urllib3-0:1.26.5-8.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-urllib3@1.26.5-8.el9_8?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-urllib3-0:1.26.5-8.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:python-urllib3-0:1.26.5-8.el9_8.src"
        },
        "product_reference": "python-urllib3-0:1.26.5-8.el9_8.src",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-urllib3-0:1.26.5-8.el9_8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:python3-urllib3-0:1.26.5-8.el9_8.noarch"
        },
        "product_reference": "python3-urllib3-0:1.26.5-8.el9_8.noarch",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-44431",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-05-13T17:01:41.663622+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477167"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.8.0.Z.MAIN.EUS:python-urllib3-0:1.26.5-8.el9_8.src",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-urllib3-0:1.26.5-8.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477167",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44431",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
        }
      ],
      "release_date": "2026-05-13T15:20:24.588000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-23T10:47:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.8.0.Z.MAIN.EUS:python-urllib3-0:1.26.5-8.el9_8.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-urllib3-0:1.26.5-8.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:28158"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.8.0.Z.MAIN.EUS:python-urllib3-0:1.26.5-8.el9_8.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-urllib3-0:1.26.5-8.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
    },
    {
      "cve": "CVE-2026-44432",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-05-13T17:01:01.083841+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.8.0.Z.MAIN.EUS:python-urllib3-0:1.26.5-8.el9_8.src",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-urllib3-0:1.26.5-8.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
        }
      ],
      "release_date": "2026-05-13T15:17:12.611000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-23T10:47:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.8.0.Z.MAIN.EUS:python-urllib3-0:1.26.5-8.el9_8.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-urllib3-0:1.26.5-8.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:28158"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.8.0.Z.MAIN.EUS:python-urllib3-0:1.26.5-8.el9_8.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-urllib3-0:1.26.5-8.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for python3.12-urllib3 is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)\n\n* urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:28159",
        "url": "https://access.redhat.com/errata/RHSA-2026:28159"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2477154",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
      },
      {
        "category": "external",
        "summary": "2477167",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
      },
      {
        "category": "external",
        "summary": "RHEL-184901",
        "url": "https://issues.redhat.com/browse/RHEL-184901"
      },
      {
        "category": "external",
        "summary": "RHEL-185126",
        "url": "https://issues.redhat.com/browse/RHEL-185126"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28159.json"
      }
    ],
    "title": "Red Hat Security Advisory: python3.12-urllib3 security update",
    "tracking": {
      "current_release_date": "2026-07-09T21:15:24+00:00",
      "generator": {
        "date": "2026-07-09T21:15:24+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.2"
        }
      },
      "id": "RHSA-2026:28159",
      "initial_release_date": "2026-06-23T10:51:21+00:00",
      "revision_history": [
        {
          "date": "2026-06-23T10:51:21+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-23T10:51:21+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-09T21:15:24+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3.12-urllib3-0:1.26.19-3.el9_8.noarch",
                "product": {
                  "name": "python3.12-urllib3-0:1.26.19-3.el9_8.noarch",
                  "product_id": "python3.12-urllib3-0:1.26.19-3.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-urllib3@1.26.19-3.el9_8?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3.12-urllib3-0:1.26.19-3.el9_8.src",
                "product": {
                  "name": "python3.12-urllib3-0:1.26.19-3.el9_8.src",
                  "product_id": "python3.12-urllib3-0:1.26.19-3.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-urllib3@1.26.19-3.el9_8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-urllib3-0:1.26.19-3.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:python3.12-urllib3-0:1.26.19-3.el9_8.noarch"
        },
        "product_reference": "python3.12-urllib3-0:1.26.19-3.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-urllib3-0:1.26.19-3.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:python3.12-urllib3-0:1.26.19-3.el9_8.src"
        },
        "product_reference": "python3.12-urllib3-0:1.26.19-3.el9_8.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-44431",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-05-13T17:01:41.663622+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477167"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:python3.12-urllib3-0:1.26.19-3.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:python3.12-urllib3-0:1.26.19-3.el9_8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477167",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44431",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
        }
      ],
      "release_date": "2026-05-13T15:20:24.588000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-23T10:51:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:python3.12-urllib3-0:1.26.19-3.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:python3.12-urllib3-0:1.26.19-3.el9_8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:28159"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:python3.12-urllib3-0:1.26.19-3.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:python3.12-urllib3-0:1.26.19-3.el9_8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
    },
    {
      "cve": "CVE-2026-44432",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-05-13T17:01:01.083841+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:python3.12-urllib3-0:1.26.19-3.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:python3.12-urllib3-0:1.26.19-3.el9_8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
        }
      ],
      "release_date": "2026-05-13T15:17:12.611000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-23T10:51:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:python3.12-urllib3-0:1.26.19-3.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:python3.12-urllib3-0:1.26.19-3.el9_8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:28159"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:python3.12-urllib3-0:1.26.19-3.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:python3.12-urllib3-0:1.26.19-3.el9_8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Quay 3.9.23 is now available with bug fixes.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Quay 3.9.23",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:28571",
        "url": "https://access.redhat.com/errata/RHSA-2026:28571"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-10143",
        "url": "https://access.redhat.com/security/cve/CVE-2026-10143"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44432"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44496",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44496"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48526",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48526"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-6322",
        "url": "https://access.redhat.com/security/cve/CVE-2026-6322"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-9277",
        "url": "https://access.redhat.com/security/cve/CVE-2026-9277"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28571.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Quay 3.9.23",
    "tracking": {
      "current_release_date": "2026-07-09T23:02:27+00:00",
      "generator": {
        "date": "2026-07-09T23:02:27+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.2"
        }
      },
      "id": "RHSA-2026:28571",
      "initial_release_date": "2026-06-23T21:51:13+00:00",
      "revision_history": [
        {
          "date": "2026-06-23T21:51:13+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-23T21:51:27+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-09T23:02:27+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Quay 3.9",
                "product": {
                  "name": "Red Hat Quay 3.9",
                  "product_id": "Red Hat Quay 3.9",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quay:3.9::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Quay"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1781940738"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1781940084"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3A312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1781942234"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1781938954"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
                  "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1781939557"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256%3Aa8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1781620752"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
                  "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256%3A0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1781938913"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
                  "product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-bundle@sha256%3A4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1781942833"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256%3A6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1781939020"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
                  "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256%3A6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1781878070"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1781940084"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1781938954"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256%3A391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1781620752"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
                  "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256%3A36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1781938913"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256%3A4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1781939020"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256%3Acf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1781878070"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1781940084"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Aab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1781938954"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256%3Adda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1781620752"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
                  "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256%3A654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1781938913"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256%3A0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1781939020"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
                  "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256%3A5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1781878070"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-6322",
      "cwe": {
        "id": "CWE-140",
        "name": "Improper Neutralization of Delimiters"
      },
      "discovery_date": "2026-05-05T11:01:00.332189+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2466684"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier (URI) that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw separators, which can change the URI\u0027s intended authority. This issue allows applications that perform host allowlist checks, redirect validation, or outbound request routing to be steered to a different authority than specified, potentially bypassing security controls.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in the `fast-uri` library allows an attacker to bypass security controls in Red Hat products that process Uniform Resource Identifiers (URIs). By crafting a malicious URI with percent-encoded authority delimiters, an attacker can cause the library to incorrectly interpret the URI\u0027s authority, potentially redirecting applications to an unintended domain. This could lead to a bypass of host allowlist checks, redirect validation, or outbound request routing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6322"
        },
        {
          "category": "external",
          "summary": "RHBZ#2466684",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466684"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6322",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6322"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6322",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6322"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc"
        }
      ],
      "release_date": "2026-05-05T10:29:16.378000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-23T21:51:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:28571"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling"
    },
    {
      "cve": "CVE-2026-9277",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-05-22T14:01:14.427751+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480741"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-9277"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480741",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480741"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-9277",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-9277"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9277",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9277"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/shell-quote",
          "url": "https://github.com/ljharb/shell-quote"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/shell-quote/commit/1518179",
          "url": "https://github.com/ljharb/shell-quote/commit/1518179"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p",
          "url": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/shell-quote",
          "url": "https://www.npmjs.com/package/shell-quote"
        }
      ],
      "release_date": "2026-05-22T13:22:38.873000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-23T21:51:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:28571"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators"
    },
    {
      "cve": "CVE-2026-10143",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-06-10T21:02:14.712750+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in kafka-python. A malicious or machine-in-the-middle broker could exploit a denial-of-service vulnerability during SCRAM authentication. By providing an excessively large iteration count, the broker can cause the client\u0027s event loop to freeze. This prevents critical operations such as sending messages, polling for new messages, and maintaining heartbeats, ultimately leading to consumer group eviction and persistent connection failures.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kafka-python: kafka-python: Denial of Service via excessive SCRAM authentication iteration count",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-10143"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-10143",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-10143"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10143",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10143"
        },
        {
          "category": "external",
          "summary": "https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b",
          "url": "https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b"
        },
        {
          "category": "external",
          "summary": "https://github.com/dpkp/kafka-python/pull/3019",
          "url": "https://github.com/dpkp/kafka-python/pull/3019"
        },
        {
          "category": "external",
          "summary": "https://github.com/dpkp/kafka-python/pull/3026",
          "url": "https://github.com/dpkp/kafka-python/pull/3026"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/kafka-python-prior-to-dos-via-scram-iteration-count-in-scram-py",
          "url": "https://www.vulncheck.com/advisories/kafka-python-prior-to-dos-via-scram-iteration-count-in-scram-py"
        }
      ],
      "release_date": "2026-06-10T20:22:39.262000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-23T21:51:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:28571"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kafka-python: kafka-python: Denial of Service via excessive SCRAM authentication iteration count"
    },
    {
      "cve": "CVE-2026-44432",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-05-13T17:01:01.083841+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
        }
      ],
      "release_date": "2026-05-13T15:17:12.611000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-23T21:51:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:28571"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
    },
    {
      "cve": "CVE-2026-44496",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-06-11T17:01:15.856386+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487943"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service (DoS), where the affected browser tab may freeze, impacting the availability of the application for the user.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Axios can lead to a client-side Denial of Service. An attacker capable of influencing the XSRF cookie name within a browser environment could trigger excessive regular expression processing, causing the affected browser tab to freeze and degrade user availability. This issue specifically impacts browser-based applications and does not affect Node.js HTTP adapter usage, React Native, or web workers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44496"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487943",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487943"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44496",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44496"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44496",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44496"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf"
        }
      ],
      "release_date": "2026-06-11T15:34:28.492000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-23T21:51:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:28571"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name"
    },
    {
      "cve": "CVE-2026-48526",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-05-28T16:01:22.805235+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2482734"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer\u0027s public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in PyJWT allows for authentication bypass and unauthorized access. It occurs when a JWT verifier is misconfigured to accept both symmetric and asymmetric algorithms, and a public JSON Web Key is erroneously used as the HMAC secret. Red Hat products are only affected if they utilize this specific, non-standard verifier configuration.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48526"
        },
        {
          "category": "external",
          "summary": "RHBZ#2482734",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48526",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48526"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx",
          "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"
        }
      ],
      "release_date": "2026-05-28T15:09:09.258000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-23T21:51:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:28571"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0ed9d3a90f5b0f2adaba21b49ef3c629d69fd3554f38d2a26525b2fdad3d4fe8_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:36dc50c6b2b176b98b05f0dce802794190122bd18ec265c40d0f9f4245b57564_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:654ef27ab24735981a6f28b743b13868f55ca94fdbd289cbbf136d4629eba75d_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:312b8a6031010e33f8df1c6e90ff63ee6ba5ec109d5c23acdfb1bb413e119a7d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25826b91cdcae78706045327f672a0544f4b9658a9914771b0fdab6a981e8bf8_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:44f88dd294f886ab69112ba29be6c04231018ad0d0192356386c4aee16207a5c_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab8f84e82313f91c17dc0b23b81a7c2aa1fc15a17e50c97e24f98936e99e67b2_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:68d268d572984190bdecf678eaba8275593549bb92b7ca518e5e6b1c820bcd75_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:391a8858036bed2cb05cf0c37d905a2f6c367f4705795cd83e181274f5aed41a_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:a8af9488daf49202bdcb7f6ecd113d65a4c73148cad818ce870c5bc0b9250bba_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dda77e696c2272f8e172e04241e8d2cb3d3004c17759d36f5b3c520b6cd8850b_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:97f36276e98ba3d93763bfe7c921bca2f41ee4f7fbdbe6052aea28122f38259b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3e637bf12fb1c68ffbe8d278b7e9377dddd91d9d597daa6451de20b9dafa9111_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4581e59d102f9bce89bb976b21d82551c1728b893106c6daa6bcbca222718340_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6fb549bf38e1972c8b7694bd38c132d4559309da05d46c9d3ca06dee08edb1bc_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:4e6449a8207bc33afc86df358ce021253040d871610c1a8681f61991b74cf121_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:0e9272374dc0faf6b8e69561f06ab5fc455999f7716ca57e4e4c811f049cb2ca_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:4ba90ed26dc4d0cb7ec9dcf0ba6ed23e33c5e0ae239e8e0fc258099d251184e4_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:6272448836f183b0b2e01598a5dcccb0c74fc35c91936e9eb5f32017d2a66f2b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:5b565745268aa52a83c9b145ef4abf1a6bb1f1aff7b08c64e461a5d959721a14_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:6f58133b6e8c814219f6ffbc25119adae1facf42108d62c8271055e507af5b00_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cf6779d291c210b654b14bf86b229d4743fd5c66e04081b8f9796e4b6e0ea040_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Quay 3.12.19 is now available with bug fixes.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Quay 3.12.19",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:30076",
        "url": "https://access.redhat.com/errata/RHSA-2026:30076"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-10143",
        "url": "https://access.redhat.com/security/cve/CVE-2026-10143"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44432"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44496",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44496"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48526",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48526"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-6322",
        "url": "https://access.redhat.com/security/cve/CVE-2026-6322"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-9277",
        "url": "https://access.redhat.com/security/cve/CVE-2026-9277"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_30076.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Quay 3.12.19",
    "tracking": {
      "current_release_date": "2026-07-09T23:02:30+00:00",
      "generator": {
        "date": "2026-07-09T23:02:30+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.2"
        }
      },
      "id": "RHSA-2026:30076",
      "initial_release_date": "2026-06-25T18:18:45+00:00",
      "revision_history": [
        {
          "date": "2026-06-25T18:18:45+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-25T18:18:49+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-09T23:02:30+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Quay 3.12",
                "product": {
                  "name": "Red Hat Quay 3.12",
                  "product_id": "Red Hat Quay 3.12",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quay:3.12::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Quay"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1782332457"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1781937016"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3A61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1782333480"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1782331980"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
                  "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1782332470"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256%3A31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1781620617"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
                  "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256%3A92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1782331838"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
                  "product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-bundle@sha256%3A3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1782333960"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256%3Ad977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1782332068"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
                  "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256%3Ab9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1781937357"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ab00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1781937016"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1782331980"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256%3A8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1781620617"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
                  "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256%3A0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62?arch=arm64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1782331838"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256%3A531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1782332068"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
                  "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256%3A09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1781937357"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ad7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1781937016"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1782331980"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256%3A8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1781620617"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
                  "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256%3A758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1782331838"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256%3A168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1782332068"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256%3Ab7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1781937357"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Af43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1781937016"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1782331980"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256%3Adf86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1781620617"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
                  "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256%3A6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1782331838"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256%3Add341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1782332068"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x",
                  "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256%3Adb1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1781937357"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64 as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64 as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64 as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64 as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64 as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64 as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64 as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64 as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64 as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64 as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64 as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64 as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64 as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64 as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64 as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64 as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x as a component of Red Hat Quay 3.12",
          "product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-6322",
      "cwe": {
        "id": "CWE-140",
        "name": "Improper Neutralization of Delimiters"
      },
      "discovery_date": "2026-05-05T11:01:00.332189+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2466684"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier (URI) that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw separators, which can change the URI\u0027s intended authority. This issue allows applications that perform host allowlist checks, redirect validation, or outbound request routing to be steered to a different authority than specified, potentially bypassing security controls.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in the `fast-uri` library allows an attacker to bypass security controls in Red Hat products that process Uniform Resource Identifiers (URIs). By crafting a malicious URI with percent-encoded authority delimiters, an attacker can cause the library to incorrectly interpret the URI\u0027s authority, potentially redirecting applications to an unintended domain. This could lead to a bypass of host allowlist checks, redirect validation, or outbound request routing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6322"
        },
        {
          "category": "external",
          "summary": "RHBZ#2466684",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466684"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6322",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6322"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6322",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6322"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc"
        }
      ],
      "release_date": "2026-05-05T10:29:16.378000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:18:45+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30076"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling"
    },
    {
      "cve": "CVE-2026-9277",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-05-22T14:01:14.427751+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480741"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-9277"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480741",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480741"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-9277",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-9277"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9277",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9277"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/shell-quote",
          "url": "https://github.com/ljharb/shell-quote"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/shell-quote/commit/1518179",
          "url": "https://github.com/ljharb/shell-quote/commit/1518179"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p",
          "url": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/shell-quote",
          "url": "https://www.npmjs.com/package/shell-quote"
        }
      ],
      "release_date": "2026-05-22T13:22:38.873000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:18:45+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30076"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators"
    },
    {
      "cve": "CVE-2026-10143",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-06-10T21:02:14.712750+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in kafka-python. A malicious or machine-in-the-middle broker could exploit a denial-of-service vulnerability during SCRAM authentication. By providing an excessively large iteration count, the broker can cause the client\u0027s event loop to freeze. This prevents critical operations such as sending messages, polling for new messages, and maintaining heartbeats, ultimately leading to consumer group eviction and persistent connection failures.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kafka-python: kafka-python: Denial of Service via excessive SCRAM authentication iteration count",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-10143"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-10143",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-10143"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10143",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10143"
        },
        {
          "category": "external",
          "summary": "https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b",
          "url": "https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b"
        },
        {
          "category": "external",
          "summary": "https://github.com/dpkp/kafka-python/pull/3019",
          "url": "https://github.com/dpkp/kafka-python/pull/3019"
        },
        {
          "category": "external",
          "summary": "https://github.com/dpkp/kafka-python/pull/3026",
          "url": "https://github.com/dpkp/kafka-python/pull/3026"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/kafka-python-prior-to-dos-via-scram-iteration-count-in-scram-py",
          "url": "https://www.vulncheck.com/advisories/kafka-python-prior-to-dos-via-scram-iteration-count-in-scram-py"
        }
      ],
      "release_date": "2026-06-10T20:22:39.262000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:18:45+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30076"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kafka-python: kafka-python: Denial of Service via excessive SCRAM authentication iteration count"
    },
    {
      "cve": "CVE-2026-44432",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-05-13T17:01:01.083841+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
        }
      ],
      "release_date": "2026-05-13T15:17:12.611000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:18:45+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30076"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
    },
    {
      "cve": "CVE-2026-44496",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-06-11T17:01:15.856386+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487943"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service (DoS), where the affected browser tab may freeze, impacting the availability of the application for the user.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Axios can lead to a client-side Denial of Service. An attacker capable of influencing the XSRF cookie name within a browser environment could trigger excessive regular expression processing, causing the affected browser tab to freeze and degrade user availability. This issue specifically impacts browser-based applications and does not affect Node.js HTTP adapter usage, React Native, or web workers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44496"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487943",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487943"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44496",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44496"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44496",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44496"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf"
        }
      ],
      "release_date": "2026-06-11T15:34:28.492000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:18:45+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30076"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name"
    },
    {
      "cve": "CVE-2026-48526",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-05-28T16:01:22.805235+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2482734"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer\u0027s public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in PyJWT allows for authentication bypass and unauthorized access. It occurs when a JWT verifier is misconfigured to accept both symmetric and asymmetric algorithms, and a public JSON Web Key is erroneously used as the HMAC secret. Red Hat products are only affected if they utilize this specific, non-standard verifier configuration.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
          "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48526"
        },
        {
          "category": "external",
          "summary": "RHBZ#2482734",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48526",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48526"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526"
        },
        {
          "category": "external",
          "summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx",
          "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"
        }
      ],
      "release_date": "2026-05-28T15:09:09.258000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:18:45+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30076"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:0285b52259e86295777d45ca169c63d5cc2ad320774fb36a83eb76b0ee906b62_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:6cbbd03b84fc2a72f0546b0f88564bdd30f694eef88699327afb94aadf6bded5_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:758da243753a713917e5d6ac61f7cb516be1f1f7714136ce1fa9c8c5383c6c91_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:92e7c9e7f90ac26681e680fd548e015a36e5760aa4ea8f8278e9ef052969dfcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:61cb89f4522d027dc7862cad2db1b0e6b8d0ee2c805e5bba5dfaa2f0a626b498_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:175cfaa83d23cb17e179d0f01a2b8c6b10a4ff0771616380421114fa46404c5e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2c13c569fcd307d333f26c098a2c0b2de9a7a0006974d98dae532e0189a7b384_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:73ba187acabd311914dd81494a5b32968fab6c8c0e943290569154e10dd2e6bb_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8ef53d785bd058442d23ca8d7cfb5034830e75e963e764a3bb78b9c5bc782df7_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4e18730e0d3a0297df2e97af0c5a16602fb3c45a1e6ef8f04339a1d6ef9f8ca7_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:31681014e706162350f17a91c3d2b348b6d930ade877839b8ddd35fadeaa4c7b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8326e2cf11416af5abcf9bf0c4a496dd6d42f90e03b9d83c10ab1b5c5537631d_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:8a0fd5087f811850d07a66718ba2f230ca1a3fa581bf88aa8be2c00fa907b88e_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:df86c2a14cd963c1efac3ef7375934ea4e432351bc45a441580d87e7da5db08f_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:876b89b047656b208af0f57881bb7ae351f53c2f875675686e5b334b74d2ac2b_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:804cfcb86df78455d539a984502f91e887b19caf8c633793a0173b481c0cd1e3_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b00b2c5a96fe210d53ae11f4d21f507e0adf9c63257cdbc9ab199455771654d0_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d7cc7f5b60db23e617782f514368fd3a20fc2e31051a7b0d13603d14c6386483_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f43d26a782e2c0994598fa1bf4d57073e272717418ac62df6f1a394a9a4a9deb_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a939af325476612b7c753c10015c36a3ab43ae4a8751aee6877621d90ebfee9_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:168e8f94d1d818026c2c3f545f37aeeacfddc8181652f49408358a91010a771a_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:531d1c071f662ae600b6e0d6cb945bb13d9155330a2e5c01b19ba01920f46874_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:d977e222cce6e053bc206fa891215e2ece1bd0c6f87a916d0899c51dca3c4fcf_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:dd341c8af0f1c6aff634d99e0d145c0a2b10f2e8f0dd3b0929eb0f27888f772c_s390x",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:09cacc9bbd0ea8f666b392a278cda7d42bd36116ec696f722d294a4d2b8cc64b_arm64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b7002e08ebee80927d071a0c3348fb1e508e65cef47671f5554d740a74a8a6fc_ppc64le",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:b9e339cb611967965c68280227825dad1018524c5ff6bc0fcf5620b2581fce1c_amd64",
            "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:db1bcca3650cdc99b46ab8c11b138220a0c90eb7475d7e36c026ebd7a57e02dd_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AI Inference Server Model Optimization Tools 3.3.5 (CUDA) is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat\u00ae AI Inference Server Model Optimization Tools",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:30078",
        "url": "https://access.redhat.com/errata/RHSA-2026:30078"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-14926",
        "url": "https://access.redhat.com/security/cve/CVE-2025-14926"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-14927",
        "url": "https://access.redhat.com/security/cve/CVE-2025-14927"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-14928",
        "url": "https://access.redhat.com/security/cve/CVE-2025-14928"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-14930",
        "url": "https://access.redhat.com/security/cve/CVE-2025-14930"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-10118",
        "url": "https://access.redhat.com/security/cve/CVE-2026-10118"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34588",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34588"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34982",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34982"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-35385",
        "url": "https://access.redhat.com/security/cve/CVE-2026-35385"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-37555",
        "url": "https://access.redhat.com/security/cve/CVE-2026-37555"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-39979",
        "url": "https://access.redhat.com/security/cve/CVE-2026-39979"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-40164",
        "url": "https://access.redhat.com/security/cve/CVE-2026-40164"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44431",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44431"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44432"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4775",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4775"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4786",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4786"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4878",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4878"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-6100",
        "url": "https://access.redhat.com/security/cve/CVE-2026-6100"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://www.redhat.com/en/products/ai/inference-server",
        "url": "https://www.redhat.com/en/products/ai/inference-server"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_30078.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.3.5 (CUDA)",
    "tracking": {
      "current_release_date": "2026-07-09T21:15:24+00:00",
      "generator": {
        "date": "2026-07-09T21:15:24+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.2"
        }
      },
      "id": "RHSA-2026:30078",
      "initial_release_date": "2026-06-25T18:29:28+00:00",
      "revision_history": [
        {
          "date": "2026-06-25T18:29:28+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-25T18:29:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-09T21:15:24+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat AI Inference Server 3.3",
                "product": {
                  "name": "Red Hat AI Inference Server 3.3",
                  "product_id": "Red Hat AI Inference Server 3.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ai_inference_server:3.3::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat AI Inference Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
                "product": {
                  "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
                  "product_id": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/model-opt-cuda-rhel9@sha256%3A21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478?arch=amd64\u0026repository_url=registry.redhat.io/rhaiis/model-opt-cuda-rhel9\u0026tag=1782352950"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64",
                "product": {
                  "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64",
                  "product_id": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/model-opt-cuda-rhel9@sha256%3Af94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969?arch=arm64\u0026repository_url=registry.redhat.io/rhaiis/model-opt-cuda-rhel9\u0026tag=1782352950"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 as a component of Red Hat AI Inference Server 3.3",
          "product_id": "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64"
        },
        "product_reference": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 as a component of Red Hat AI Inference Server 3.3",
          "product_id": "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        },
        "product_reference": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14926",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2025-12-23T22:01:56.621147+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2424723"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Hugging Face Transformers library. The convert_config function fails to validate a user-supplied string before using it to execute Python code. An attacker can exploit this flaw by providing a malicious SEW model checkpoint, causing arbitrary code execution in the context of the user converting the file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "transformers: code execution when converting a malicious SEW model checkpoint",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker must convince a user to process a specially crafted SEW model checkpoint, limiting the possibility of exploitation. Additionally, model checkpoints are not typically processed by users with administrative privileges, limiting the potential for a full system compromise. Due to these reasons, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14926"
        },
        {
          "category": "external",
          "summary": "RHBZ#2424723",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2424723"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14926",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14926"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14926",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14926"
        },
        {
          "category": "external",
          "summary": "https://www.zerodayinitiative.com/advisories/ZDI-25-1147/",
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1147/"
        }
      ],
      "release_date": "2025-12-23T21:04:32.162000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid converting SEW model checkpoints from untrusted or unverified sources. Ensure that all SEW model checkpoints processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "transformers: code execution when converting a malicious SEW model checkpoint"
    },
    {
      "cve": "CVE-2025-14927",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2025-12-23T22:04:01.976430+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2424751"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Hugging Face Transformers library. The convert_config function fails to validate a user-supplied string before using it to execute Python code. An attacker can exploit this flaw by providing a malicious SEW-D model checkpoint, causing arbitrary code execution in the context of the user converting the file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "transformers: code execution when converting a malicious SEW-D model checkpoint",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker must convince a user to process a specially crafted SEW-D model checkpoint, limiting the possibility of exploitation. Additionally, model checkpoints are not typically processed by users with administrative privileges, limiting the potential for a full system compromise. Due to these reasons, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14927"
        },
        {
          "category": "external",
          "summary": "RHBZ#2424751",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2424751"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14927",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14927"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14927",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14927"
        },
        {
          "category": "external",
          "summary": "https://www.zerodayinitiative.com/advisories/ZDI-25-1148/",
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1148/"
        }
      ],
      "release_date": "2025-12-23T21:04:28.008000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid converting SEW-D model checkpoints from untrusted or unverified sources. Ensure that all SEW-D model checkpoints processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "transformers: code execution when converting a malicious SEW-D model checkpoint"
    },
    {
      "cve": "CVE-2025-14928",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2025-12-23T22:02:35.224747+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2424731"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Hugging Face Transformers library. The convert_config function fails to validate a user-supplied string before using it to execute Python code. An attacker can exploit this flaw by providing a malicious HuBERT model checkpoint, causing arbitrary code execution in the context of the user converting the file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "transformers: code execution when converting a malicious HuBERT model checkpoint",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker must convince a user to process a specially crafted HuBERT model checkpoint, limiting the possibility of exploitation. Additionally, model checkpoints are not typically processed by users with administrative privileges, limiting the potential for a full system compromise. Due to these reasons, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14928"
        },
        {
          "category": "external",
          "summary": "RHBZ#2424731",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2424731"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14928",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14928"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14928",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14928"
        },
        {
          "category": "external",
          "summary": "https://www.zerodayinitiative.com/advisories/ZDI-25-1146/",
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1146/"
        }
      ],
      "release_date": "2025-12-23T21:04:48.438000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid converting HuBERT model checkpoints from untrusted or unverified sources. Ensure that all HuBERT model checkpoints processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "transformers: code execution when converting a malicious HuBERT model checkpoint"
    },
    {
      "cve": "CVE-2025-14930",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2025-12-23T22:05:28.509553+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2424769"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Hugging Face Transformers library. The parsing of weights fails to validate user-supplied data, causing a deserialization of untrusted data. An attacker can exploit this issue by providing a malicious GLM4 model, resulting in arbitrary code execution in the context of the current user processing the file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "transformers: code execution when processing a malicious GLM4 model file",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker must convince a user to process a specially crafted GLM4 model file or visiting a malicious page, limiting the possibility of exploitation. Additionally, model files are not typically processed by users with administrative privileges, limiting the potential for a full system compromise. Due to these reasons, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14930"
        },
        {
          "category": "external",
          "summary": "RHBZ#2424769",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2424769"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14930",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14930"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14930",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14930"
        },
        {
          "category": "external",
          "summary": "https://www.zerodayinitiative.com/advisories/ZDI-25-1145/",
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1145/"
        }
      ],
      "release_date": "2025-12-23T21:04:52.512000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid processing GLM4 model files from untrusted or unverified sources. Ensure that all GLM4 model files processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "transformers: code execution when processing a malicious GLM4 model file"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Quang Luong",
            "PrymEvol"
          ]
        }
      ],
      "cve": "CVE-2026-4775",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-03-24T14:23:23.826000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2450768"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw in the libtiff library, affecting the processing of specially crafted TIFF files, could lead to a denial of service or potentially arbitrary code execution. This vulnerability, caused by a signed integer overflow during TIFF image processing, results in an out-of-bounds heap write. Red Hat products that process untrusted TIFF files using libtiff may be impacted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4775"
        },
        {
          "category": "external",
          "summary": "RHBZ#2450768",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450768"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4775",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4775"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4775",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4775"
        }
      ],
      "release_date": "2026-03-24T14:33:35.730000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid processing untrusted or maliciously crafted TIFF files with applications linked against the libtiff library. If processing untrusted TIFF files is unavoidable, consider running the affected applications within a sandboxed environment to limit the potential impact of successful exploitation. This operational control helps contain the effects of an out-of-bounds write, reducing the risk of denial of service or arbitrary code execution.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing"
    },
    {
      "cve": "CVE-2026-4786",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "discovery_date": "2026-04-13T22:01:38.006388+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2458049"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Python webbrowser.open() API. If a specially crafted URL containing \"%action\" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in the Python `webbrowser.open()` API allows for command injection and arbitrary code execution when processing specially crafted URLs containing \"%action\". This bypasses a previous mitigation for CVE-2026-4519.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4786"
        },
        {
          "category": "external",
          "summary": "RHBZ#2458049",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4786",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4786"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4786",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4786"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/148169",
          "url": "https://github.com/python/cpython/issues/148169"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/148170",
          "url": "https://github.com/python/cpython/pull/148170"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/"
        }
      ],
      "release_date": "2026-04-13T21:52:19.036000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Ali Raza"
          ]
        }
      ],
      "cve": "CVE-2026-4878",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-03-26T06:56:21.213270+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2451615"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw. A Time-of-Check-to-Time-of-Use (TOCTOU) race condition in libcap\u0027s cap_set_file() allows a local unprivileged user to escalate privileges. An attacker with write access to a parent directory can exploit a narrow window during file capability updates to redirect capabilities to an attacker-controlled file. This can lead to the injection of elevated privileges into an unintended executable when privileged processes, such as setcap or container tooling, invoke cap_set_file() on attacker-influenced paths.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4878"
        },
        {
          "category": "external",
          "summary": "RHBZ#2451615",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4878",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4878"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4878",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4878"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554"
        }
      ],
      "release_date": "2026-04-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()"
    },
    {
      "cve": "CVE-2026-6100",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-04-13T18:01:31.970255+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457932"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Python\u0027s decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is experiencing high memory usage. Exploitation of this flaw could potentially allow an attacker to execute arbitrary code or access sensitive data. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The severity of this flaw is somewhat mitigated on Red Hat platforms. By default processes are not executed with root user privilege and are limited in their scope which in turn limits the impact of this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6100"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457932",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6100",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6100"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6100",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6100"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d",
          "url": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2",
          "url": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20",
          "url": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/148395",
          "url": "https://github.com/python/cpython/issues/148395"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/148396",
          "url": "https://github.com/python/cpython/pull/148396"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/"
        }
      ],
      "release_date": "2026-04-13T17:15:47.606000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "AISLE Research"
          ],
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-10118",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-04-21T23:20:23+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460428"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Poppler\u0027s Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important heap-based memory corruption flaw in Poppler\u0027s Splash backend. Processing a specially crafted PDF document can lead to an integer overflow, resulting in an undersized heap allocation and a subsequent out-of-bounds write. This could allow an attacker to achieve arbitrary code execution, disclose sensitive information, or cause a denial of service within the context of the application rendering the PDF. To successfully exploit this vulnerability the attacker needs to be able to supply the maliciously crafted PDF file to the application consuming poppler or trick the user to process the PDF file using the Poppler\u0027s backend.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-10118"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460428",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460428"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-10118",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-10118"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10118",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10118"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1715",
          "url": "https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1715"
        }
      ],
      "release_date": "2026-06-01T15:25:35.578000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid opening untrusted or suspicious PDF documents with applications that utilize the Poppler library for rendering. Limiting exposure to untrusted content can reduce the risk of exploitation.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication"
    },
    {
      "cve": "CVE-2026-34588",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-04-06T16:02:38.673068+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455408"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenEXR, an image storage format for the motion picture industry. A remote attacker could exploit an integer overflow vulnerability in the `internal_exr_undo_piz()` function by providing a specially crafted EXR file. This flaw leads to out-of-bounds reads and writes, which may allow for arbitrary code execution or sensitive information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34588"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455408",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455408"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34588",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34588"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34588",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34588"
        },
        {
          "category": "external",
          "summary": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf",
          "url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf"
        }
      ],
      "release_date": "2026-04-06T15:31:57.602000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file"
    },
    {
      "cve": "CVE-2026-34982",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-04-06T16:02:10.004743+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455400"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim. A modeline is used to set specific editor options directly from a text file. However, the `complete`, `guitabtooltip`, `printheader` options and the `mapset` function lack proper security checks, allowing an attacker to bypass restrictions and cause arbitrary OS command execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: arbitrary command execution via modeline sandbox bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this vulnerability, an attacker needs to convince a user to open a specially crafted file. The arbitrary OS command execution is restricted to the privileges of the user running Vim, limiting the potential of a full system compromise.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34982"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455400",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455400"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34982",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34982"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34982",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34982"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/04/01/1",
          "url": "http://www.openwall.com/lists/oss-security/2026/04/01/1"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615",
          "url": "https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0276",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0276"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9"
        }
      ],
      "release_date": "2026-04-06T15:16:48.809000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable the modeline support by adding the following command to the Vim configuration file:\n\n~~~\nset nomodeline\n~~~",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: arbitrary command execution via modeline sandbox bypass"
    },
    {
      "cve": "CVE-2026-35385",
      "cwe": {
        "id": "CWE-281",
        "name": "Improper Preservation of Permissions"
      },
      "discovery_date": "2026-04-02T17:01:07.052864+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2454469"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. When the `scp` command is used by a root user to download a file with the legacy protocol option (`-O`) and without preserving original file permissions (`-p`), the downloaded file can be installed with elevated privileges (setuid or setgid). This unexpected behavior could allow a malicious file to execute with higher permissions than intended, posing a security risk through potential privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-35385"
        },
        {
          "category": "external",
          "summary": "RHBZ#2454469",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454469"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-35385",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-35385"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35385",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35385"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.3p1",
          "url": "https://www.openssh.org/releasenotes.html#10.3p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/04/02/3",
          "url": "https://www.openwall.com/lists/oss-security/2026/04/02/3"
        }
      ],
      "release_date": "2026-04-02T16:30:59.615000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode"
    },
    {
      "cve": "CVE-2026-37555",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-04-29T17:00:55.901773+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2463856"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the libsndfile library. An integer overflow in the IMA ADPCM codec can occur when a specially crafted WAV audio file is processed, specifically with malicious samplesperblock and blocks values. This can lead to a heap-based buffer overflow, causing a crash to the application linked to the library and memory corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsndfile: integer overflow in ima_reader_init()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs to be able to process a malicious WAV file with an application linked to the libsndfile library.\n\nDefault Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.\n\nDue to these reasons, this flaw has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-37555"
        },
        {
          "category": "external",
          "summary": "RHBZ#2463856",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463856"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-37555",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-37555"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-37555",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-37555"
        },
        {
          "category": "external",
          "summary": "https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151",
          "url": "https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151"
        },
        {
          "category": "external",
          "summary": "https://github.com/libsndfile/libsndfile/issues/833",
          "url": "https://github.com/libsndfile/libsndfile/issues/833"
        }
      ],
      "release_date": "2026-04-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "Do not process untrusted WAV files with the libsndfile library.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libsndfile: integer overflow in ima_reader_init()"
    },
    {
      "cve": "CVE-2026-39979",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-04-13T23:01:01.219840+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2458077"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jq, a command line JSON processor, specifically in the libjq API. Parsing a malformed JSON input from a non-NUL-terminated buffer using the `jv_parse_sized` function can cause an out-of-bounds read, resulting in an application crash and a possible memory disclosure within the error message generated by the parser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker needs to supply malformed JSON from a non-NUL-terminated buffer to an application using the `jv_parse_sized` function. This allows the attacker to trigger the out-of-bounds read, causing an application crash and potentially disclosing memory with no other security impact. As this issue affects the libjq library, it is more likely to be exposed to untrusted input. Due to these reasons, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39979"
        },
        {
          "category": "external",
          "summary": "RHBZ#2458077",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458077"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39979",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39979"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39979",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39979"
        },
        {
          "category": "external",
          "summary": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f",
          "url": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f"
        },
        {
          "category": "external",
          "summary": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p",
          "url": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p"
        }
      ],
      "release_date": "2026-04-13T22:18:56.252000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, manually ensure that every buffer is NUL-terminated before passing it to the \u0027jv_parse_sized\u0027 function.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers"
    },
    {
      "cve": "CVE-2026-40164",
      "cwe": {
        "id": "CWE-341",
        "name": "Predictable from Observable State"
      },
      "discovery_date": "2026-04-14T00:01:04.003115+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2458084"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq\u0027s hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause hash collisions, an attacker can degrade the performance of JSON object hash table operations, leading to significant CPU exhaustion and a denial of service (DoS) for systems processing the malicious JSON data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jq: jq: Denial of Service via crafted JSON object causing hash collisions",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-40164"
        },
        {
          "category": "external",
          "summary": "RHBZ#2458084",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458084"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-40164",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40164"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40164",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40164"
        },
        {
          "category": "external",
          "summary": "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784",
          "url": "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784"
        },
        {
          "category": "external",
          "summary": "https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29",
          "url": "https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29"
        }
      ],
      "release_date": "2026-04-13T23:40:12.693000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jq: jq: Denial of Service via crafted JSON object causing hash collisions"
    },
    {
      "cve": "CVE-2026-44431",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-05-13T17:01:41.663622+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477167"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477167",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44431",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
        }
      ],
      "release_date": "2026-05-13T15:20:24.588000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
    },
    {
      "cve": "CVE-2026-44432",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-05-13T17:01:01.083841+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
        }
      ],
      "release_date": "2026-05-13T15:17:12.611000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
    }
  ]
}