Vulnerability-Lookup

RHSA-2026:13812

Vulnerability from csaf_redhat - Published: 2026-05-05 17:47 - Updated: 2026-09-01 11:58

Summary

Red Hat Security Advisory: updated RHEL-8 based Middleware Containers container images

Severity

Important

Notes

Topic: Updated RHEL-8 based Middleware Containers container images are now available

Details: The RHEL-8 based Middleware Containers container images have been updated to address the following security advisory: RHSA-2026:11077 RHSA-2026:7667 RHSA-2026:8534 RHSA-2026:9745 (see References) Security Fixes: * rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158) * gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function (CVE-2025-9820) * gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification (CVE-2025-14831) * openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables (CVE-2026-3497) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing (CVE-2026-4424) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing (CVE-2026-5121) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) Users of RHEL-8 based Middleware Containers container images are advised to upgrade to these updated images, which contain backported patches to correct these security issues, fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images. You can find images updated by this advisory in Red Hat Container Catalog (see References).

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-9820

A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.

4.0 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-121 - Stack-based Buffer Overflow

Affected products

Fixed 7 products

Product	Version	Remediation
Unresolved product id: 8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64	—	Vendor Fix fix Workaround

Known not affected 1 product

Product	Identifier	Version	Remediation
Unresolved product id: 8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64		—	Workaround

Threats

Impact Low

CVE-2025-10158

An out of bounds read flaw has been discovered in rsync. A malicious client acting as the receiver of an rsync file transfer can trigger an OOB read via a negative array index. The rsync client requires at least read access to the remote rsync module to trigger the issue.

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE-129 - Improper Validation of Array Index

Affected products

Fixed 7 products, the same list as for CVE-2025-9820

Known not affected 1 product, the same list as for CVE-2025-9820

Threats

Impact Moderate

CVE-2025-14831

A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-407 - Inefficient Algorithmic Complexity

Affected products

Fixed 7 products, the same list as for CVE-2025-9820

Known not affected 1 product, the same list as for CVE-2025-9820

Threats

Impact Moderate

CVE-2026-3497

A flaw was found in the OpenSSH GSSAPI (Generic Security Service Application Program Interface) delta patches, as included in various Linux distributions. A remote attacker could exploit this by sending an unexpected GSSAPI message type during the key exchange process. This occurs because the `sshpkt_disconnect()` function, when called on an error, does not properly terminate the process, leading to the continued execution of the program with uninitialized connection variables. Accessing these uninitialized variables can lead to undefined behavior, potentially resulting in information disclosure or a denial of service.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

CWE-824 - Access of Uninitialized Pointer

Affected products

Fixed 7 products, the same list as for CVE-2025-9820

Known not affected 1 product, the same list as for CVE-2025-9820

Threats

Impact Important

CVE-2026-4424

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 7 products, the same list as for CVE-2025-9820

Known not affected 1 product, the same list as for CVE-2025-9820

Threats

Impact Important

CVE-2026-4519

A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Affected products

Fixed 7 products, the same list as for CVE-2025-9820

Known not affected 1 product, the same list as for CVE-2025-9820

Threats

Impact Important

CVE-2026-4786

A flaw was found in the Python webbrowser.open() API. If a specially crafted URL containing "%action" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution.

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Affected products

Fixed 7 products, the same list as for CVE-2025-9820

Known not affected 1 product, the same list as for CVE-2025-9820

Threats

Impact Important

CVE-2026-5121

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 7 products, the same list as for CVE-2025-9820

Known not affected 1 product, the same list as for CVE-2025-9820

Threats

Impact Moderate

CVE-2026-6100

A flaw was found in Python's decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is experiencing high memory usage. Exploitation of this flaw could potentially allow an attacker to execute arbitrary code or access sensitive data. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 7 products, the same list as for CVE-2025-9820

Known not affected 1 product, the same list as for CVE-2025-9820

Threats

Impact Important

CVE-2026-27135

A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 7 products, the same list as for CVE-2025-9820

Known not affected 1 product, the same list as for CVE-2025-9820

Threats

Impact Important

References

84 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:13812	self
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/errata/RHSA-2026:11077	external
https://access.redhat.com/errata/RHSA-2026:7667	external
https://access.redhat.com/errata/RHSA-2026:8534	external
https://access.redhat.com/errata/RHSA-2026:9745	external
https://errata.engineering.redhat.com/advisory/165062	external
https://access.redhat.com/containers	external
https://bugzilla.redhat.com/show_bug.cgi?id=2392528	external
https://bugzilla.redhat.com/show_bug.cgi?id=2415637	external
https://bugzilla.redhat.com/show_bug.cgi?id=2423177	external
https://bugzilla.redhat.com/show_bug.cgi?id=2447085	external
https://bugzilla.redhat.com/show_bug.cgi?id=2448754	external
https://bugzilla.redhat.com/show_bug.cgi?id=2449006	external
https://bugzilla.redhat.com/show_bug.cgi?id=2449649	external
https://bugzilla.redhat.com/show_bug.cgi?id=2452945	external
https://bugzilla.redhat.com/show_bug.cgi?id=2457932	external
https://bugzilla.redhat.com/show_bug.cgi?id=2458049	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-9820	self
https://bugzilla.redhat.com/show_bug.cgi?id=2392528	external
https://www.cve.org/CVERecord?id=CVE-2025-9820	external
https://nvd.nist.gov/vuln/detail/CVE-2025-9820	external
https://gitlab.com/gnutls/gnutls/-/commit/1d56f96…	external
https://gitlab.com/gnutls/gnutls/-/issues/1732	external
https://www.gnutls.org/security-new.html#GNUTLS-S…	external
https://access.redhat.com/security/cve/CVE-2025-10158	self
https://bugzilla.redhat.com/show_bug.cgi?id=2415637	external
https://www.cve.org/CVERecord?id=CVE-2025-10158	external
https://nvd.nist.gov/vuln/detail/CVE-2025-10158	external
https://attackerkb.com/assessments/fbacb2a6-d1cd-…	external
https://github.com/RsyncProject/rsync/commit/797e…	external
https://access.redhat.com/security/cve/CVE-2025-14831	self
https://bugzilla.redhat.com/show_bug.cgi?id=2423177	external
https://www.cve.org/CVERecord?id=CVE-2025-14831	external
https://nvd.nist.gov/vuln/detail/CVE-2025-14831	external
https://gitlab.com/gnutls/gnutls/-/issues/1773	external
https://access.redhat.com/security/cve/CVE-2026-3497	self
https://bugzilla.redhat.com/show_bug.cgi?id=2447085	external
https://www.cve.org/CVERecord?id=CVE-2026-3497	external
https://nvd.nist.gov/vuln/detail/CVE-2026-3497	external
https://ubuntu.com/security/CVE-2026-3497	external
https://www.openwall.com/lists/oss-security/2026/…	external
https://access.redhat.com/security/cve/CVE-2026-4424	self
https://bugzilla.redhat.com/show_bug.cgi?id=2449006	external
https://www.cve.org/CVERecord?id=CVE-2026-4424	external
https://nvd.nist.gov/vuln/detail/CVE-2026-4424	external
https://github.com/libarchive/libarchive/pull/2898	external
https://access.redhat.com/security/cve/CVE-2026-4519	self
https://bugzilla.redhat.com/show_bug.cgi?id=2449649	external
https://www.cve.org/CVERecord?id=CVE-2026-4519	external
https://nvd.nist.gov/vuln/detail/CVE-2026-4519	external
https://github.com/python/cpython/issues/143930	external
https://github.com/python/cpython/pull/143931	external
https://mail.python.org/archives/list/security-an…	external
https://access.redhat.com/security/cve/CVE-2026-4786	self
https://bugzilla.redhat.com/show_bug.cgi?id=2458049	external
https://www.cve.org/CVERecord?id=CVE-2026-4786	external
https://nvd.nist.gov/vuln/detail/CVE-2026-4786	external
https://github.com/python/cpython/issues/148169	external
https://github.com/python/cpython/pull/148170	external
https://mail.python.org/archives/list/security-an…	external
https://access.redhat.com/security/cve/CVE-2026-5121	self
https://bugzilla.redhat.com/show_bug.cgi?id=2452945	external
https://www.cve.org/CVERecord?id=CVE-2026-5121	external
https://nvd.nist.gov/vuln/detail/CVE-2026-5121	external
https://github.com/advisories/GHSA-2vwv-vqpv-v8vc	external
https://github.com/libarchive/libarchive/pull/2934	external
https://access.redhat.com/security/cve/CVE-2026-6100	self
https://bugzilla.redhat.com/show_bug.cgi?id=2457932	external
https://www.cve.org/CVERecord?id=CVE-2026-6100	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6100	external
https://github.com/python/cpython/commit/6a5f79c8…	external
https://github.com/python/cpython/commit/8fc66aef…	external
https://github.com/python/cpython/commit/c3cf71c3…	external
https://github.com/python/cpython/issues/148395	external
https://github.com/python/cpython/pull/148396	external
https://mail.python.org/archives/list/security-an…	external
https://access.redhat.com/security/cve/CVE-2026-27135	self
https://bugzilla.redhat.com/show_bug.cgi?id=2448754	external
https://www.cve.org/CVERecord?id=CVE-2026-27135	external
https://nvd.nist.gov/vuln/detail/CVE-2026-27135	external
https://github.com/nghttp2/nghttp2/commit/5c7df8f…	external
https://github.com/nghttp2/nghttp2/security/advis…	external

Acknowledgments

Elhanan Haenel

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated RHEL-8 based Middleware Containers container images are now available",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The RHEL-8 based Middleware Containers container images have been updated to address the following security advisory: \nRHSA-2026:11077 \nRHSA-2026:7667\nRHSA-2026:8534\nRHSA-2026:9745\n(see References)\n\nSecurity Fixes:\n* rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158)\n* gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function (CVE-2025-9820)\n* gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification (CVE-2025-14831)\n* openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables (CVE-2026-3497) \n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n* libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing  (CVE-2026-4424)\n* python: Python: Command-line option injection in webbrowser.open() via crafted URLs  (CVE-2026-4519)\n* libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing  (CVE-2026-5121) \n* python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)\n* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)\n\nUsers of RHEL-8 based Middleware Containers container images are advised to upgrade to these updated images, which contain backported patches to correct these security issues, fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images.\n\nYou can find images updated by this advisory in Red Hat Container Catalog (see References).",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:13812",
        "url": "https://access.redhat.com/errata/RHSA-2026:13812"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/errata/RHSA-2026:11077",
        "url": "https://access.redhat.com/errata/RHSA-2026:11077"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/errata/RHSA-2026:7667",
        "url": "https://access.redhat.com/errata/RHSA-2026:7667"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/errata/RHSA-2026:8534",
        "url": "https://access.redhat.com/errata/RHSA-2026:8534"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/errata/RHSA-2026:9745",
        "url": "https://access.redhat.com/errata/RHSA-2026:9745"
      },
      {
        "category": "external",
        "summary": "https://errata.engineering.redhat.com/advisory/165062",
        "url": "https://errata.engineering.redhat.com/advisory/165062"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/containers",
        "url": "https://access.redhat.com/containers"
      },
      {
        "category": "external",
        "summary": "2392528",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392528"
      },
      {
        "category": "external",
        "summary": "2415637",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2415637"
      },
      {
        "category": "external",
        "summary": "2423177",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423177"
      },
      {
        "category": "external",
        "summary": "2447085",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447085"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "external",
        "summary": "2449006",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449006"
      },
      {
        "category": "external",
        "summary": "2449649",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
      },
      {
        "category": "external",
        "summary": "2452945",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452945"
      },
      {
        "category": "external",
        "summary": "2457932",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
      },
      {
        "category": "external",
        "summary": "2458049",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13812.json"
      }
    ],
    "title": "Red Hat Security Advisory: updated RHEL-8 based Middleware Containers container images",
    "tracking": {
      "current_release_date": "2026-09-01T11:58:09+00:00",
      "generator": {
        "date": "2026-09-01T11:58:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:13812",
      "initial_release_date": "2026-05-05T17:47:50+00:00",
      "revision_history": [
        {
          "date": "2026-05-05T17:47:50+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-05-05T17:47:50+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-01T11:58:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Middleware Containers for OpenShift",
                "product": {
                  "name": "Middleware Containers for OpenShift",
                  "product_id": "8Base-RHOSE-Middleware",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhosemc:1.0::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
                "product": {
                  "name": "rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
                  "product_id": "rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0?arch=amd64\u0026repository_url=registry.redhat.io/rhpam-7/rhpam-businesscentral-monitoring-rhel8\u0026tag=7.13.5-4.1777325677"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
                "product": {
                  "name": "rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
                  "product_id": "rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e?arch=amd64\u0026repository_url=registry.redhat.io/rhpam-7/rhpam-businesscentral-rhel8\u0026tag=7.13.5-4.1777325711"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
                "product": {
                  "name": "rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
                  "product_id": "rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d?arch=amd64\u0026repository_url=registry.redhat.io/rhpam-7/rhpam-controller-rhel8\u0026tag=7.13.5-4.1777325710"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
                "product": {
                  "name": "rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
                  "product_id": "rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673?arch=amd64\u0026repository_url=registry.redhat.io/rhpam-7/rhpam-dashbuilder-rhel8\u0026tag=7.13.5-3.1777325680"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
                "product": {
                  "name": "rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
                  "product_id": "rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d?arch=amd64\u0026repository_url=registry.redhat.io/rhpam-7/rhpam-kieserver-rhel8\u0026tag=7.13.5-4.1777325709"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
                "product": {
                  "name": "rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
                  "product_id": "rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904?arch=amd64\u0026repository_url=registry.redhat.io/rhpam-7/rhpam-process-migration-rhel8\u0026tag=7.13.5-4.1777325680"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64",
                "product": {
                  "name": "rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64",
                  "product_id": "rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17?arch=amd64\u0026repository_url=registry.redhat.io/rhpam-7/rhpam-smartrouter-rhel8\u0026tag=7.13.5-4.1777325708"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
                "product": {
                  "name": "rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
                  "product_id": "rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931?arch=amd64\u0026repository_url=registry.redhat.io/rhpam-7/rhpam-operator-bundle\u0026tag=7.13.5-40"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64"
        },
        "product_reference": "rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64"
        },
        "product_reference": "rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64"
        },
        "product_reference": "rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64"
        },
        "product_reference": "rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64"
        },
        "product_reference": "rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
        },
        "product_reference": "rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64"
        },
        "product_reference": "rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
        },
        "product_reference": "rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-9820",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "discovery_date": "2025-09-02T10:00:18.839000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2392528"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Low, since exploitation requires local access or a malicious PKCS#11 token. While the impact is limited to denial of service or potential code execution in constrained scenarios, the vulnerability stems from a lack of proper bounds checking during token label handling in GnuTLS. Users should treat this as a security concern in environments where untrusted tokens may be introduced.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
        ],
        "known_not_affected": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-9820"
        },
        {
          "category": "external",
          "summary": "RHBZ#2392528",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392528"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-9820",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-9820"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9820",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9820"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/gnutls/gnutls/-/commit/1d56f96f6ab5034d677136b9d50b5a75dff0faf5",
          "url": "https://gitlab.com/gnutls/gnutls/-/commit/1d56f96f6ab5034d677136b9d50b5a75dff0faf5"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/gnutls/gnutls/-/issues/1732",
          "url": "https://gitlab.com/gnutls/gnutls/-/issues/1732"
        },
        {
          "category": "external",
          "summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18",
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18"
        }
      ],
      "release_date": "2025-11-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-05T17:47:50+00:00",
          "details": "The RHEL-8 based Middleware Containers container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:13812"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Applying the upstream patch or vendor-supplied security update is the recommended resolution.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function"
    },
    {
      "cve": "CVE-2025-10158",
      "cwe": {
        "id": "CWE-129",
        "name": "Improper Validation of Array Index"
      },
      "discovery_date": "2025-11-18T15:01:12.887910+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2415637"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out of bounds read flaw has been discovered in rsync. A malicious client acting as the receiver of an rsync file transfer can trigger an OOB read via a negative array index. The rsync client requires at least read access to the remote rsync module to trigger the issue.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rsync: Rsync: Out of bounds array access via negative index",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
        ],
        "known_not_affected": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-10158"
        },
        {
          "category": "external",
          "summary": "RHBZ#2415637",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2415637"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-10158",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-10158"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-10158",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10158"
        },
        {
          "category": "external",
          "summary": "https://attackerkb.com/assessments/fbacb2a6-d1cd-4011-bb3a-f06b1c8306b1",
          "url": "https://attackerkb.com/assessments/fbacb2a6-d1cd-4011-bb3a-f06b1c8306b1"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/commit/797e17fc4a6f15e3b1756538a9f812b63942686f",
          "url": "https://github.com/RsyncProject/rsync/commit/797e17fc4a6f15e3b1756538a9f812b63942686f"
        }
      ],
      "release_date": "2025-11-18T14:24:19.210000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-05T17:47:50+00:00",
          "details": "The RHEL-8 based Middleware Containers container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:13812"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rsync: Rsync: Out of bounds array access via negative index"
    },
    {
      "cve": "CVE-2025-14831",
      "cwe": {
        "id": "CWE-407",
        "name": "Inefficient Algorithmic Complexity"
      },
      "discovery_date": "2025-12-17T14:48:30.222000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2423177"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat. GnuTLS is susceptible to a denial of service attack due to excessive CPU and memory consumption. This occurs when processing specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs) during certificate verification.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
        ],
        "known_not_affected": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14831"
        },
        {
          "category": "external",
          "summary": "RHBZ#2423177",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423177"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14831",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14831"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14831",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14831"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/gnutls/gnutls/-/issues/1773",
          "url": "https://gitlab.com/gnutls/gnutls/-/issues/1773"
        }
      ],
      "release_date": "2026-02-09T14:26:34.939000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-05T17:47:50+00:00",
          "details": "The RHEL-8 based Middleware Containers container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:13812"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification"
    },
    {
      "cve": "CVE-2026-3497",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-03-12T19:01:37.007806+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447085"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OpenSSH GSSAPI (Generic Security Service Application Program Interface) delta patches, as included in various Linux distributions. A remote attacker could exploit this by sending an unexpected GSSAPI message type during the key exchange process. This occurs because the `sshpkt_disconnect()` function, when called on an error, does not properly terminate the process, leading to the continued execution of the program with uninitialized connection variables. Accessing these uninitialized variables can lead to undefined behavior, potentially resulting in information disclosure or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "IMPORTANT: This vulnerability affects the OpenSSH GSSAPI delta as implemented in Red Hat Enterprise Linux and OpenShift Container Platform. An unauthenticated attacker could send a specially crafted GSSAPI message during key exchange, leading to the use of uninitialized variables and potentially undefined behavior. The severity of the impact is dependent on compiler hardening configurations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
        ],
        "known_not_affected": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3497"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447085",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447085"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3497",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3497"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3497",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3497"
        },
        {
          "category": "external",
          "summary": "https://ubuntu.com/security/CVE-2026-3497",
          "url": "https://ubuntu.com/security/CVE-2026-3497"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/03/12/3",
          "url": "https://www.openwall.com/lists/oss-security/2026/03/12/3"
        }
      ],
      "release_date": "2026-03-12T18:27:44.917000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-05T17:47:50+00:00",
          "details": "The RHEL-8 based Middleware Containers container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:13812"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable GSSAPI key exchange in the OpenSSH server configuration. This prevents the server from processing GSSAPI messages, eliminating the vulnerability\u0027s attack surface.\n\nEdit `/etc/ssh/sshd_config` and add or modify the line:\n```\nGSSAPIKeyExchange no\n```\n\nAfter saving the changes, restart the `sshd` service for the mitigation to take effect. This action will prevent users from authenticating via GSSAPI.\n\n```\n# systemctl restart sshd\n```",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Elhanan Haenel"
          ]
        }
      ],
      "cve": "CVE-2026-4424",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-03-19T12:22:21.740000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449006"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "IMPORTANT: This heap out-of-bounds read vulnerability in libarchive\u0027s RAR archive processing logic can lead to information disclosure. A remote attacker can exploit this flaw by providing a specially crafted RAR archive, potentially revealing sensitive heap memory information without requiring authentication or user interaction on systems that process untrusted archives.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
        ],
        "known_not_affected": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4424"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449006",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449006"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4424",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4424"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4424",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4424"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/2898",
          "url": "https://github.com/libarchive/libarchive/pull/2898"
        }
      ],
      "release_date": "2026-03-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-05T17:47:50+00:00",
          "details": "The RHEL-8 based Middleware Containers container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:13812"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing"
    },
    {
      "cve": "CVE-2026-4519",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "discovery_date": "2026-03-20T16:02:13.494105+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449649"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
        ],
        "known_not_affected": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4519"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449649",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4519",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4519"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/143930",
          "url": "https://github.com/python/cpython/issues/143930"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/143931",
          "url": "https://github.com/python/cpython/pull/143931"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/"
        }
      ],
      "release_date": "2026-03-20T15:08:32.576000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-05T17:47:50+00:00",
          "details": "The RHEL-8 based Middleware Containers container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:13812"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs"
    },
    {
      "cve": "CVE-2026-4786",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "discovery_date": "2026-04-13T22:01:38.006388+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2458049"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Python webbrowser.open() API. If a specially crafted URL containing \"%action\" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in the Python `webbrowser.open()` API allows for command injection and arbitrary code execution when processing specially crafted URLs containing \"%action\". This bypasses a previous mitigation for CVE-2026-4519.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
        ],
        "known_not_affected": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4786"
        },
        {
          "category": "external",
          "summary": "RHBZ#2458049",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4786",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4786"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4786",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4786"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/148169",
          "url": "https://github.com/python/cpython/issues/148169"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/148170",
          "url": "https://github.com/python/cpython/pull/148170"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/"
        }
      ],
      "release_date": "2026-04-13T21:52:19.036000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-05T17:47:50+00:00",
          "details": "The RHEL-8 based Middleware Containers container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:13812"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Elhanan Haenel"
          ]
        }
      ],
      "cve": "CVE-2026-5121",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-03-30T07:40:25.358335+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2452945"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: An integer overflow flaw in `libarchive` on 32-bit systems can lead to a heap buffer overflow. This vulnerability occurs when processing a specially crafted ISO9660 image, allowing an attacker to potentially execute arbitrary code. Red Hat Enterprise Linux 64-bit systems are not affected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
        ],
        "known_not_affected": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5121"
        },
        {
          "category": "external",
          "summary": "RHBZ#2452945",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452945"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5121",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5121"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5121",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5121"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-2vwv-vqpv-v8vc",
          "url": "https://github.com/advisories/GHSA-2vwv-vqpv-v8vc"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/2934",
          "url": "https://github.com/libarchive/libarchive/pull/2934"
        }
      ],
      "release_date": "2026-03-30T07:44:15.222000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-05T17:47:50+00:00",
          "details": "The RHEL-8 based Middleware Containers container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:13812"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid processing untrusted ISO9660 images with applications that utilize `libarchive`. Users should only extract or read content from ISO images obtained from trusted sources.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing"
    },
    {
      "cve": "CVE-2026-6100",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-04-13T18:01:31.970255+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457932"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Python\u0027s decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is experiencing high memory usage. Exploitation of this flaw could potentially allow an attacker to execute arbitrary code or access sensitive data. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The severity of this flaw is somewhat mitigated on Red Hat platforms. By default processes are not executed with root user privilege and are limited in their scope which in turn limits the impact of this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
        ],
        "known_not_affected": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6100"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457932",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6100",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6100"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6100",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6100"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d",
          "url": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2",
          "url": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20",
          "url": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/148395",
          "url": "https://github.com/python/cpython/issues/148395"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/148396",
          "url": "https://github.com/python/cpython/pull/148396"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/"
        }
      ],
      "release_date": "2026-04-13T17:15:47.606000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-05T17:47:50+00:00",
          "details": "The RHEL-8 based Middleware Containers container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:13812"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules"
    },
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
        ],
        "known_not_affected": [
          "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-05T17:47:50+00:00",
          "details": "The RHEL-8 based Middleware Containers container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:13812"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:92df715c896f06f6aa93b631bd62e3a146bad3cd08666cbab955d5cccdad0ea0_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-businesscentral-rhel8@sha256:23b2eace9e0e381d6a8db37a11ebef3a092f7b14352b3a05187c7b9e78f6e60e_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-controller-rhel8@sha256:6a8c527be5f7140866dca164d60ab484d40f28281becd849907f8740a8a2a87d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-dashbuilder-rhel8@sha256:64efe627bd982759b2492ca8bf4d31315c68bf0262c0ca448a93335a11c81673_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-kieserver-rhel8@sha256:56ce30c3d224f65df05b066f39741797836687b4aeab7d7269bf5d28f45dc04d_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-operator-bundle@sha256:3378f77e5a1823d197c755b020e725ff0e72784994c0a755347a0999cef65931_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-process-migration-rhel8@sha256:a4a34e29ddb6f9d60e64f19bac7fe49eb0b66fcbb6803cbc6563b77e7d7f9904_amd64",
            "8Base-RHOSE-Middleware:rhpam-7/rhpam-smartrouter-rhel8@sha256:14df06eab56c17b7f718884c7379098ec3842ed99d6c5778dc2810ac9b1d4c17_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    }
  ]
}

CVE-2025-10158 (GCVE-0-2025-10158)

Vulnerability from cvelistv5 – Published: 2025-11-18 14:24 – Updated: 2025-11-19 16:48

Title

Rsync: Out of bounds array access via negative index

Summary

A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-11-19 16:15 UTC

CWE

CWE-129 - Improper Validation of Array Index

Assigner

rapid7 mitre root

References

2 references

URL	Tags
https://github.com/RsyncProject/rsync/commit/797e…	patch
https://attackerkb.com/assessments/fbacb2a6-d1cd-…	technical-description

Impacted products

1 product

Vendor	Product	Version
rsync	rsync	Affected: 0 , ≤ 3.4.1 (semver)

Date Public

2025-11-18 14:20

Credits

Calum Hutton

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-10158",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-19T16:15:02.998218Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-19T16:48:56.591Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rsync",
          "vendor": "rsync",
          "versions": [
            {
              "lessThanOrEqual": "3.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Calum Hutton"
        }
      ],
      "datePublic": "2025-11-18T14:20:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue."
            }
          ],
          "value": "A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-129",
              "description": "CWE-129 Improper Validation of Array Index",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-18T14:45:58.065Z",
        "orgId": "9974b330-7714-4307-a722-5648477acda7",
        "shortName": "rapid7"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/RsyncProject/rsync/commit/797e17fc4a6f15e3b1756538a9f812b63942686f"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://attackerkb.com/assessments/fbacb2a6-d1cd-4011-bb3a-f06b1c8306b1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2025-03-19T06:11:00.000Z",
          "value": "Rapid7 makes initial outreach to rsync maintainers"
        },
        {
          "lang": "en",
          "time": "2025-03-19T10:04:00.000Z",
          "value": "Rsync maintainers confirm outreach"
        },
        {
          "lang": "en",
          "time": "2025-03-20T10:34:00.000Z",
          "value": "Rapid7 provides rsync maintainers a technical writeup and PoC to reproduce the issue"
        },
        {
          "lang": "en",
          "time": "2025-04-02T03:05:00.000Z",
          "value": "Rapid7 requests confirmation of findings"
        },
        {
          "lang": "en",
          "time": "2025-04-06T09:30:00.000Z",
          "value": "Rsync maintainers indicate more time is needed"
        },
        {
          "lang": "en",
          "time": "2025-04-16T05:31:00.000Z",
          "value": "Rsync maintainers reproduce the issue and dispute its security impact due to uncertainty around viability of heap manipulation during exploitation"
        },
        {
          "lang": "en",
          "time": "2025-04-17T01:56:00.000Z",
          "value": "Rapid7 indicates manipulating the heap is nuanced and CVE assignment is both prudent and best practice in this instance"
        },
        {
          "lang": "en",
          "time": "2025-05-07T09:08:00.000Z",
          "value": "Rapid7 requests an update"
        },
        {
          "lang": "en",
          "time": "2025-05-12T06:08:00.000Z",
          "value": "Rsync maintainers indicate a pull request to fix the issue is forthcoming"
        },
        {
          "lang": "en",
          "time": "2025-05-28T09:40:00.000Z",
          "value": "Rapid7 requests an update"
        },
        {
          "lang": "en",
          "time": "2025-06-17T04:19:00.000Z",
          "value": "Rapid7 requests an update"
        },
        {
          "lang": "en",
          "time": "2025-08-18T11:59:00.000Z",
          "value": "Rapid7 requests an update"
        },
        {
          "lang": "en",
          "time": "2025-08-23T09:17:00.000Z",
          "value": "Rsync maintainers indicate a pull request to remediate the issue has been made and a feature release is forthcoming"
        },
        {
          "lang": "en",
          "time": "2025-09-02T04:23:00.000Z",
          "value": "Rapid7 indicates intention to assign a CVE and perform a coordinated disclosure with the rsync maintainers upon the upcoming feature release"
        },
        {
          "lang": "en",
          "time": "2025-09-09T11:18:00.000Z",
          "value": "Rapid7 provides rsync maintainers a reserved CVE identifier and requests the date for the expected feature release"
        },
        {
          "lang": "en",
          "time": "2025-11-11T04:42:00.000Z",
          "value": "Rapid7 indicates intention to publish the CVE record on November 18, 2025."
        },
        {
          "lang": "en",
          "time": "2025-11-18T14:00:00.000Z",
          "value": "This disclosure"
        }
      ],
      "title": "Rsync: Out of bounds array access via negative index",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
    "assignerShortName": "rapid7",
    "cveId": "CVE-2025-10158",
    "datePublished": "2025-11-18T14:24:19.210Z",
    "dateReserved": "2025-09-09T11:15:17.585Z",
    "dateUpdated": "2025-11-19T16:48:56.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14831 (GCVE-0-2025-14831)

Vulnerability from cvelistv5 – Published: 2026-02-09 14:51 – Updated: 2026-09-01 11:52

Title

Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification

Summary

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-09 15:25 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

redhat redhat root

References

28 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:13812	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16008	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16009	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16174	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25096	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30849	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30850	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33125	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3477	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:4188	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:4655	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:4943	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:5585	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:5606	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6618	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6630	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6737	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6738	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7329	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7335	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7477	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8746	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8747	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8748	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-14831	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2423177	issue-trackingx_refsource_REDHAT
https://gitlab.com/gnutls/gnutls/-/issues/1773
https://cert-portal.siemens.com/productcert/html/…

Impacted products

48 products

Vendor	Product	Version
		Affected: 0
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.8.10-3.el10_1 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:3.8.9-9.el10_0.17 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.6.16-8.el8_10.5 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:3.6.14-10.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:4.13-3.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:3.6.14-10.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:4.13-3.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:3.6.16-5.el8_6.5 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_eus_long_life:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.13-3.el8_6.2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_eus_long_life:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:3.6.16-5.el8_6.5 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_eus_long_life:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:4.13-3.el8_6.2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_eus_long_life:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:3.6.16-7.el8_8.4 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.13-4.el8_8.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:3.6.16-7.el8_8.4 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.13-4.el8_8.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.8.3-10.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:3.7.6-21.el9_2.5 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::appstream cpe:/o:redhat:rhel_e4s:9.2::baseos
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:3.8.3-4.el9_4.5 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4::appstream cpe:/o:redhat:rhel_eus:9.4::baseos
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:3.8.3-6.el9_6.3 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6::appstream cpe:/o:redhat:rhel_eus:9.6::baseos
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325677 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325711 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325710 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-3.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325709 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325708 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1780681984 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1775740563 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244559 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244531 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244546 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1775680192 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1775680262 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1775749857 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat Ceph Storage 8	Unaffected: 1774002867 , < * (rpm) cpe:/a:redhat:ceph_storage:8::el9
Red Hat	Red Hat Discovery 2	Unaffected: 1775668717 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Discovery 2	Unaffected: 1775675922 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Hardened Images	Unaffected: 3.8.12-1.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Insights proxy 1.5	Unaffected: 1773685509 , < * (rpm) cpe:/a:redhat:insights_proxy:1.5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1773670073 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1773672059 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1773668803 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1773670137 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Siemens	SIMATIC CN 4100	Affected: 0 , < V5.0 (custom)

Date Public

2026-02-09 14:26

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14831",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-09T15:25:49.680881Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-09T15:26:01.239Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:02:57.683Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.com/gnutls/gnutls",
          "packageName": "gnutls",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.1"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.8.10-3.el10_1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux_eus:10.0"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.8.9-9.el10_0.17",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.16-8.el8_10.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.16-8.el8_10.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.14-10.el8_4.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libtasn1",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.13-3.el8_4.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.14-10.el8_4.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libtasn1",
          "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.13-3.el8_4.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.16-5.el8_6.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libtasn1",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.13-3.el8_6.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.16-5.el8_6.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libtasn1",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.13-3.el8_6.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream",
            "cpe:/o:redhat:rhel_e4s:8.8::baseos",
            "cpe:/o:redhat:rhel_tus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.16-7.el8_8.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream",
            "cpe:/o:redhat:rhel_e4s:8.8::baseos",
            "cpe:/o:redhat:rhel_tus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libtasn1",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.13-4.el8_8.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream",
            "cpe:/o:redhat:rhel_e4s:8.8::baseos",
            "cpe:/o:redhat:rhel_tus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.16-7.el8_8.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream",
            "cpe:/o:redhat:rhel_e4s:8.8::baseos",
            "cpe:/o:redhat:rhel_tus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libtasn1",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.13-4.el8_8.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.8.3-10.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.8.3-10.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream",
            "cpe:/o:redhat:rhel_e4s:9.2::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.7.6-21.el9_2.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream",
            "cpe:/o:redhat:rhel_eus:9.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.8.3-4.el9_4.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream",
            "cpe:/o:redhat:rhel_eus:9.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.8.3-6.el9_6.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-businesscentral-monitoring-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325677",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-businesscentral-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325711",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-controller-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325710",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-dashbuilder-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-3.1777325680",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-kieserver-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325709",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-process-migration-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325680",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-smartrouter-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325708",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/model-opt-cuda-rhel9",
          "product": "Red Hat AI Inference Server 3.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1780681984",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-cuda-rhel9",
          "product": "Red Hat AI Inference Server 3.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1775740563",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/model-opt-cuda-rhel9",
          "product": "Red Hat AI Inference Server 3.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778244559",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-rocm-rhel9",
          "product": "Red Hat AI Inference Server 3.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778244531",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-spyre-rhel9",
          "product": "Red Hat AI Inference Server 3.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778244546",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-cuda-rhel9",
          "product": "Red Hat AI Inference Server 3.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1775680192",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-rocm-rhel9",
          "product": "Red Hat AI Inference Server 3.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1775680262",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/model-opt-cuda-rhel9",
          "product": "Red Hat AI Inference Server 3.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1775749857",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ceph_storage:8::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhceph/rhceph-8-rhel9",
          "product": "Red Hat Ceph Storage 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1774002867",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "discovery/discovery-server-rhel9",
          "product": "Red Hat Discovery 2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1775668717",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "discovery/discovery-ui-rhel9",
          "product": "Red Hat Discovery 2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1775675922",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3.8.12-1.1.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:insights_proxy:1.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "insights-proxy/insights-proxy-container-rhel9",
          "product": "Red Hat Insights proxy 1.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1773685509",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/cds-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1773670073",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/haproxy-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1773672059",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/installer-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1773668803",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/rhua-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1773670137",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-02-09T14:26:34.939Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T11:52:36.870Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:13812",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:13812"
        },
        {
          "name": "RHSA-2026:16008",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:16008"
        },
        {
          "name": "RHSA-2026:16009",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:16009"
        },
        {
          "name": "RHSA-2026:16174",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:16174"
        },
        {
          "name": "RHSA-2026:25096",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:25096"
        },
        {
          "name": "RHSA-2026:30849",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:30849"
        },
        {
          "name": "RHSA-2026:30850",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:30850"
        },
        {
          "name": "RHSA-2026:33125",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:33125"
        },
        {
          "name": "RHSA-2026:3477",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:3477"
        },
        {
          "name": "RHSA-2026:4188",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:4188"
        },
        {
          "name": "RHSA-2026:4655",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:4655"
        },
        {
          "name": "RHSA-2026:4943",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:4943"
        },
        {
          "name": "RHSA-2026:5585",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:5585"
        },
        {
          "name": "RHSA-2026:5606",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "name": "RHSA-2026:6618",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:6618"
        },
        {
          "name": "RHSA-2026:6630",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:6630"
        },
        {
          "name": "RHSA-2026:6737",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:6737"
        },
        {
          "name": "RHSA-2026:6738",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:6738"
        },
        {
          "name": "RHSA-2026:7329",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:7329"
        },
        {
          "name": "RHSA-2026:7335",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:7335"
        },
        {
          "name": "RHSA-2026:7477",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:7477"
        },
        {
          "name": "RHSA-2026:8746",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8746"
        },
        {
          "name": "RHSA-2026:8747",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8747"
        },
        {
          "name": "RHSA-2026:8748",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8748"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-14831"
        },
        {
          "name": "RHBZ#2423177",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423177"
        },
        {
          "url": "https://gitlab.com/gnutls/gnutls/-/issues/1773"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-12-17T14:48:30.222Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-02-09T14:26:34.939Z",
          "value": "Made public."
        }
      ],
      "title": "Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-407: Inefficient Algorithmic Complexity"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-14831",
    "datePublished": "2026-02-09T14:51:32.447Z",
    "dateReserved": "2025-12-17T14:44:59.859Z",
    "dateUpdated": "2026-09-01T11:52:36.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-9820 (GCVE-0-2025-9820)

Vulnerability from cvelistv5 – Published: 2026-01-26 19:58 – Updated: 2026-09-01 12:08

Title

Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

Summary

Severity

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-26 20:10 UTC

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

redhat redhat root

References

16 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:13812	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3477	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:4188	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:4655	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:4943	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:5585	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:5606	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7329	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7477	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-9820	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2392528	issue-trackingx_refsource_REDHAT
https://gitlab.com/gnutls/gnutls/-/commit/1d56f96…
https://gitlab.com/gnutls/gnutls/-/issues/1732
https://www.gnutls.org/security-new.html#GNUTLS-S…
http://www.openwall.com/lists/oss-security/2025/11/20/2
https://cert-portal.siemens.com/productcert/html/…

Impacted products

24 products

Vendor	Product	Version
		Affected: 3.8.1 Affected: 3.8.2 Affected: 3.8.3 Affected: 3.8.4 Affected: 3.8.5 Affected: 3.8.6 Affected: 3.8.7 Affected: 3.8.8 Affected: 3.8.9 Affected: 3.8.10
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.8.10-3.el10_1 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.6.16-8.el8_10.5 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.8.3-10.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325677 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325711 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325710 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-3.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325709 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325708 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	Red Hat Ceph Storage 8	Unaffected: 1774002867 , < * (rpm) cpe:/a:redhat:ceph_storage:8::el9
Red Hat	Red Hat Discovery 2	Unaffected: 1775668717 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Discovery 2	Unaffected: 1775675922 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Hardened Images	Unaffected: 3.8.12-1.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Insights proxy 1.5	Unaffected: 1773685509 , < * (rpm) cpe:/a:redhat:insights_proxy:1.5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1773670073 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1773672059 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1773668803 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1773670137 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Siemens	SIMATIC CN 4100	Affected: 0 , < V5.0 (custom)

Date Public

2025-11-18 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-26T20:08:12.926Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/11/20/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9820",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-26T20:10:45.615719Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-26T20:12:19.249Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:02:44.799Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.com/gnutls/gnutls",
          "packageName": "gnutls",
          "versions": [
            {
              "status": "affected",
              "version": "3.8.1"
            },
            {
              "status": "affected",
              "version": "3.8.2"
            },
            {
              "status": "affected",
              "version": "3.8.3"
            },
            {
              "status": "affected",
              "version": "3.8.4"
            },
            {
              "status": "affected",
              "version": "3.8.5"
            },
            {
              "status": "affected",
              "version": "3.8.6"
            },
            {
              "status": "affected",
              "version": "3.8.7"
            },
            {
              "status": "affected",
              "version": "3.8.8"
            },
            {
              "status": "affected",
              "version": "3.8.9"
            },
            {
              "status": "affected",
              "version": "3.8.10"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.1"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.8.10-3.el10_1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.16-8.el8_10.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.16-8.el8_10.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.8.3-10.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.8.3-10.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-businesscentral-monitoring-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325677",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-businesscentral-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325711",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-controller-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325710",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-dashbuilder-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-3.1777325680",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-kieserver-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325709",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-process-migration-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325680",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-smartrouter-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325708",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ceph_storage:8::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhceph/rhceph-8-rhel9",
          "product": "Red Hat Ceph Storage 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1774002867",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "discovery/discovery-server-rhel9",
          "product": "Red Hat Discovery 2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1775668717",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "discovery/discovery-ui-rhel9",
          "product": "Red Hat Discovery 2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1775675922",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3.8.12-1.1.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:insights_proxy:1.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "insights-proxy/insights-proxy-container-rhel9",
          "product": "Red Hat Insights proxy 1.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1773685509",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/cds-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1773670073",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/haproxy-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1773672059",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/installer-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1773668803",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/rhua-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1773670137",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-11-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T12:08:43.365Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:13812",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:13812"
        },
        {
          "name": "RHSA-2026:3477",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:3477"
        },
        {
          "name": "RHSA-2026:4188",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:4188"
        },
        {
          "name": "RHSA-2026:4655",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:4655"
        },
        {
          "name": "RHSA-2026:4943",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:4943"
        },
        {
          "name": "RHSA-2026:5585",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:5585"
        },
        {
          "name": "RHSA-2026:5606",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "name": "RHSA-2026:7329",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:7329"
        },
        {
          "name": "RHSA-2026:7477",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:7477"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-9820"
        },
        {
          "name": "RHBZ#2392528",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392528"
        },
        {
          "url": "https://gitlab.com/gnutls/gnutls/-/commit/1d56f96f6ab5034d677136b9d50b5a75dff0faf5"
        },
        {
          "url": "https://gitlab.com/gnutls/gnutls/-/issues/1732"
        },
        {
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-09-02T10:00:18.839Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-11-18T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Applying the upstream patch or vendor-supplied security update is the recommended resolution."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-121: Stack-based Buffer Overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-9820",
    "datePublished": "2026-01-26T19:58:32.886Z",
    "dateReserved": "2025-09-02T07:22:32.478Z",
    "dateUpdated": "2026-09-01T12:08:43.365Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27135 (GCVE-0-2026-27135)

Vulnerability from cvelistv5 – Published: 2026-03-18 17:59 – Updated: 2026-09-08 08:46

Title

nghttp2 Denial of service: Assertion failure due to the missing state validation

Summary

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-18 18:36 UTC

CWE

CWE-617 - Reachable Assertion

Assigner

GitHub_M mitre root

References

55 references

URL	Tags
https://github.com/nghttp2/nghttp2/security/advis…	x_refsource_CONFIRM
https://github.com/nghttp2/nghttp2/commit/5c7df8f…	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2026/03/20/3
https://lists.debian.org/debian-lts-announce/2026…
https://access.redhat.com/security/cve/CVE-2026-27135	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2448754	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:27200	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21695	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13812	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21690	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:15087	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14773	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20087	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17596	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21656	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20040	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8868	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7310	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7666	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7080	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7675	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8339	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7123	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7670	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9711	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9874	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7983	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7896	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7302	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7350	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7667	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8541	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8539	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8538	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8540	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8546	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8545	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8547	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8548	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7668	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25096	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19724	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19725	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16008	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16030	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16009	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16174	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14937	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6190	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9832	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27201	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11768	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10065	vendor-advisoryx_refsource_REDHAT
https://cert-portal.siemens.com/productcert/html/…

Impacted products

68 products

Vendor	Product	Version
nghttp2	nghttp2	Affected: < 1.68.1
Red Hat	JBoss Core Services for RHEL 8	Unaffected: 0:1.64.0-3.el8jbcs , < * (rpm) cpe:/a:redhat:jboss_core_services:1::el8
Red Hat	JBoss Core Services on RHEL 7	Unaffected: 0:1.64.0-3.el7jbcs , < * (rpm) cpe:/a:redhat:jboss_core_services:1::el7
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:22.22.2-1.el10_1 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:1.64.0-2.el10_1.1 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:24.14.1-2.el10_1 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 1:22.22.2-2.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:1.64.0-2.el10_0.1 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260331102257.6d880403 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260408131901.6d880403 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260414073138.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.33.0-6.el8_10.2 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:1.33.0-3.el8_2.4 , < * (rpm) cpe:/o:redhat:rhel_aus:8.2
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:1.33.0-4.el8_4.3 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:1.33.0-4.el8_4.3 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:1.33.0-4.el8_6.3 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:1.33.0-4.el8_6.3 , < * (rpm) cpe:/o:redhat:rhel_tus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:1.33.0-4.el8_6.3 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:1.33.0-5.el8_8.2 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:1.33.0-5.el8_8.2 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9070020260401095228.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9070020260402152654.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9070020260409073121.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.43.0-6.el9_7.1 , < * (rpm) cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:1.43.0-5.el9_0.4 , < * (rpm) cpe:/o:redhat:rhel_e4s:9.0
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:1.43.0-5.el9_2.4 , < * (rpm) cpe:/o:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 9040020260421133644.rhel9 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:1.43.0-5.el9_4.4 , < * (rpm) cpe:/o:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 9060020260409121057.rhel9 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 9060020260422064119.rhel9 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:1.43.0-6.el9_6.1 , < * (rpm) cpe:/o:redhat:rhel_eus:9.6
Red Hat	Red Hat JBoss Core Services 2.4.62.SP4	cpe:/a:redhat:jboss_core_services:1
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 412.86.202605271418-0 , < * (rpm) cpe:/a:redhat:openshift:4.12::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 413.92.202605271328-0 , < * (rpm) cpe:/a:redhat:openshift:4.13::el9
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 414.92.202605060243-0 , < * (rpm) cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 415.92.202605060220-0 , < * (rpm) cpe:/a:redhat:openshift:4.15::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 416.94.202605200242-0 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 417.94.202605112123-0 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 418.94.202605260517-0 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 4.19.9.6.202605201155-0 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325677 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325711 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325710 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-3.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325709 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325708 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1779223654 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1779223651 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1780681984 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244559 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244531 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778274666 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244546 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat Discovery 2	Unaffected: 1778101579 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Discovery 2	Unaffected: 1778156756 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Hardened Images	Unaffected: 1.68.1-1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Insights proxy 1.5	Unaffected: 1776868961 , < * (rpm) cpe:/a:redhat:insights_proxy:1.5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868774 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868744 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868772 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868842 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1777459441 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1777454300 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1777459504 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27135",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-18T18:36:41.841104Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-18T18:36:48.198Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-13T21:31:25.337Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/20/3"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00025.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "jbcs-httpd24-nghttp2",
            "product": "JBoss Core Services for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.64.0-3.el8jbcs",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "jbcs-httpd24-nghttp2",
            "product": "JBoss Core Services on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.64.0-3.el7jbcs",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs22",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:22.22.2-1.el10_1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.64.0-2.el10_1.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs24",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:24.14.1-2.el10_1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs22",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:22.22.2-2.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.64.0-2.el10_0.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:22",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260331102257.6d880403",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:24",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260408131901.6d880403",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:20",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260414073138.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.33.0-6.el8_10.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.2"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2",
            "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.33.0-3.el8_2.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.33.0-4.el8_4.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.33.0-4.el8_4.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.33.0-4.el8_6.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2",
            "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.33.0-4.el8_6.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2",
            "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.33.0-4.el8_6.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.33.0-5.el8_8.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.33.0-5.el8_8.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:22",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9070020260401095228.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:24",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9070020260402152654.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:20",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9070020260409073121.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.43.0-6.el9_7.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.0"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2",
            "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.43.0-5.el9_0.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.43.0-5.el9_2.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:20",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9040020260421133644.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.43.0-5.el9_4.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:22",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9060020260409121057.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:20",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9060020260422064119.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.43.0-6.el9_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_core_services:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "nghttp2",
            "product": "Red Hat JBoss Core Services 2.4.62.SP4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "412.86.202605271418-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "413.92.202605271328-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "414.92.202605060243-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "415.92.202605060220-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "416.94.202605200242-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "417.94.202605112123-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "418.94.202605260517-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.19.9.6.202605201155-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-businesscentral-monitoring-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325677",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-businesscentral-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325711",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-controller-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325710",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-dashbuilder-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-3.1777325680",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-kieserver-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325709",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-process-migration-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325680",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-smartrouter-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325708",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779223654",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-rocm-rhel9",
            "product": "Red Hat AI Inference Server 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779223651",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/model-opt-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780681984",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/model-opt-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778244559",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-rocm-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778244531",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778274666",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-spyre-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778244546",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:discovery:2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "discovery/discovery-server-rhel9",
            "product": "Red Hat Discovery 2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778101579",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:discovery:2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "discovery/discovery-ui-rhel9",
            "product": "Red Hat Discovery 2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778156756",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nghttp2-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.68.1-1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:insights_proxy:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "insights-proxy/insights-proxy-container-rhel9",
            "product": "Red Hat Insights proxy 1.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776868961",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/cds-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776868774",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/haproxy-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776868744",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/installer-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776868772",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776868842",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/cds-kubernetes-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777459441",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/installer-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777454300",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777459504",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "datePublic": "2026-03-18T17:59:02.045Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS)."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-617",
                "description": "Reachable Assertion",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T12:04:46.342Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
          },
          {
            "name": "RHBZ#2448754",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27200"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21695"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13812"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21690"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:15087"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14773"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:20087"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17596"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21656"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:20040"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8868"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7310"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7666"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7080"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7675"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8339"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7123"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7670"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9711"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9874"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7983"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7896"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7302"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7350"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7667"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8541"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8539"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8538"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8540"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8546"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8545"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8547"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8548"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7668"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25096"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19724"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19725"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16008"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16030"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16009"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16174"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14937"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6190"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9832"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27201"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:11768"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10065"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:27200: Red Hat JBoss Core Services on RHEL 7 Server, Red Hat JBoss Core Services on RHEL 8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21695: Red Hat OpenShift Container Platform 4.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13812: Middleware Containers for OpenShift"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21690: Red Hat OpenShift Container Platform 4.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:15087: Red Hat OpenShift Container Platform 4.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14773: Red Hat OpenShift Container Platform 4.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:20087: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17596: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21656: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:20040: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8868: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7310: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7666: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7080: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7675: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8339: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7123: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7670: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9711: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9874: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7983: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7896: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7302: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7350: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7667: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8541: Red Hat Enterprise Linux BaseOS AUS (v. 8.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8539: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8538: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS E4S (v.8.6), Red Hat Enterprise Linux BaseOS TUS (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8540: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8546: Red Hat Enterprise Linux BaseOS E4S (v.9.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8545: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8547: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8548: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7668: Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25096: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19724: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19725: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16008: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16030: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16009: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16174: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14937: Red Hat Discovery 2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6190: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9832: Red Hat Insights proxy 1.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27201: Red Hat JBoss Core Services 2.4.62.SP4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:11768: Red Hat Update Infrastructure 5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10065: Red Hat Update Infrastructure 5"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-03-18T19:02:13.823Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-03-18T17:59:02.045Z",
            "value": "Made public."
          }
        ],
        "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:46:37.199Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nghttp2",
          "vendor": "nghttp2",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.68.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-617",
              "description": "CWE-617: Reachable Assertion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-18T17:59:02.045Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        },
        {
          "name": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        }
      ],
      "source": {
        "advisory": "GHSA-6933-cjhr-5qg6",
        "discovery": "UNKNOWN"
      },
      "title": "nghttp2 Denial of service: Assertion failure due to the missing state validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27135",
    "datePublished": "2026-03-18T17:59:02.045Z",
    "dateReserved": "2026-02-17T18:42:27.044Z",
    "dateUpdated": "2026-09-08T08:46:37.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-3497 (GCVE-0-2026-3497)

Vulnerability from cvelistv5 – Published: 2026-03-12 18:27 – Updated: 2026-09-08 08:44

Summary

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.

Severity

2.7 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-12 19:04 UTC

CWE

CWE-908 - Use of Uninitialized Resource
CWE-824 - Access of Uninitialized Pointer

Assigner

canonical mitre root

References

43 references

URL	Tags
https://ubuntu.com/security/CVE-2026-3497	vdb-entry
https://www.openwall.com/lists/oss-security/2026/…
http://www.openwall.com/lists/oss-security/2026/03/12/3
http://www.openwall.com/lists/oss-security/2026/03/14/3
http://www.openwall.com/lists/oss-security/2026/03/14/4
http://www.openwall.com/lists/oss-security/2026/03/18/2
http://www.openwall.com/lists/oss-security/2026/03/18/4
http://www.openwall.com/lists/oss-security/2026/03/18/5
http://www.openwall.com/lists/oss-security/2026/03/18/7
https://lists.debian.org/debian-lts-announce/2026…
https://access.redhat.com/security/cve/CVE-2026-3497	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2447085	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:21695	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13812	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21690	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:15087	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14773	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20087	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17596	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:12071	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20040	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7107	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6463	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6461	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:15891	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:15893	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14924	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13750	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10714	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9732	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9415	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6462	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25096	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19724	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19725	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16008	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16030	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16009	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16174	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:5475	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10065	vendor-advisoryx_refsource_REDHAT
https://cert-portal.siemens.com/productcert/html/…

Impacted products

49 products

Vendor	Product	Version
Ubuntu	openssh	Affected: 1:10.0p1-5ubuntu5 , < 1:10.0p1-5ubuntu5.1 (dpkg) Affected: 1:9.6p1-3ubuntu13 , < 1:9.6p1-3ubuntu13.15 (dpkg) Affected: 1:8.9p1-3 , < 1:8.9p1-3ubuntu0.14 (dpkg)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:9.9p1-13.el10_1 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:9.9p1-7.el10_0.2 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:8.0p1-28.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:8.0p1-7.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:8.0p1-7.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:8.0p1-15.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:8.0p1-15.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_tus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:8.0p1-15.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:8.0p1-20.el8_8.3 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:8.0p1-20.el8_8.3 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:8.7p1-48.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:8.7p1-13.el9_0.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:8.7p1-30.el9_2.10 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:8.7p1-38.el9_4.7 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:8.7p1-45.el9_6.2 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 412.86.202605271418-0 , < * (rpm) cpe:/a:redhat:openshift:4.12::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 413.92.202605271328-0 , < * (rpm) cpe:/a:redhat:openshift:4.13::el9
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 414.92.202605060243-0 , < * (rpm) cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 415.92.202605060220-0 , < * (rpm) cpe:/a:redhat:openshift:4.15::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 416.94.202605200242-0 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 417.94.202605112123-0 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 418.94.202604240015-0 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 4.19.9.6.202605201155-0 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325677 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325711 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325710 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-3.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325709 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325708 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1779223654 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1779223651 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1780681984 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244559 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244531 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778274666 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244546 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat Hardened Images	Unaffected: 10.2p1-9.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868772 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868842 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Multicluster Engine for Kubernetes	cpe:/a:redhat:multicluster_engine
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	cpe:/a:redhat:acm:2
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Date Public

2026-03-12 18:00

Credits

Jeremy Brown

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3497",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-12T19:04:05.760026Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-12T19:04:27.229Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-04-16T18:24:30.556Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/12/3"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/14/3"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/14/4"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/18/2"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/18/4"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/18/5"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/18/7"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/04/msg00014.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1"
            ],
            "defaultStatus": "affected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:9.9p1-13.el10_1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:9.9p1-7.el10_0.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8",
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0p1-28.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0p1-7.el8_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0p1-7.el8_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0p1-15.el8_6.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0p1-15.el8_6.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0p1-15.el8_6.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0p1-20.el8_8.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0p1-20.el8_8.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.7p1-48.el9_7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.0"
            ],
            "defaultStatus": "affected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.7p1-13.el9_0.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.7p1-30.el9_2.10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.7p1-38.el9_4.7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.7p1-45.el9_6.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "412.86.202605271418-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "413.92.202605271328-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "414.92.202605060243-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "415.92.202605060220-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "416.94.202605200242-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "417.94.202605112123-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "418.94.202604240015-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.19.9.6.202605201155-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-businesscentral-monitoring-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325677",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-businesscentral-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325711",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-controller-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325710",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-dashbuilder-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-3.1777325680",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-kieserver-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325709",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-process-migration-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325680",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-smartrouter-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325708",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779223654",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-rocm-rhel9",
            "product": "Red Hat AI Inference Server 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779223651",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/model-opt-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780681984",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/model-opt-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778244559",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-rocm-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778244531",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778274666",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-spyre-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778244546",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openssh-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "10.2p1-9.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/installer-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776868772",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776868842",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "unknown",
            "packageName": "multicluster-engine/hive-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-pipelines/pipelines-resolvers-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openssh",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-03-12T18:27:44.917Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the OpenSSH GSSAPI (Generic Security Service Application Program Interface) delta patches, as included in various Linux distributions. A remote attacker could exploit this by sending an unexpected GSSAPI message type during the key exchange process. This occurs because the `sshpkt_disconnect()` function, when called on an error, does not properly terminate the process, leading to the continued execution of the program with uninitialized connection variables. Accessing these uninitialized variables can lead to undefined behavior, potentially resulting in information disclosure or a denial of service."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-824",
                "description": "Access of Uninitialized Pointer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T12:04:59.845Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-3497"
          },
          {
            "name": "RHBZ#2447085",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447085"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3497.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21695"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13812"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21690"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:15087"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14773"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:20087"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17596"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:12071"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:20040"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7107"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6463"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6461"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:15891"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:15893"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14924"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13750"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10714"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9732"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9415"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6462"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25096"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19724"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19725"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16008"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16030"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16009"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16174"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:5475"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10065"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:21695: Red Hat OpenShift Container Platform 4.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13812: Middleware Containers for OpenShift"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21690: Red Hat OpenShift Container Platform 4.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:15087: Red Hat OpenShift Container Platform 4.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14773: Red Hat OpenShift Container Platform 4.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:20087: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17596: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:12071: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:20040: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7107: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6463: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6461: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:15891: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4), Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:15893: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6), Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS E4S (v.8.6), Red Hat Enterprise Linux BaseOS TUS (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14924: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8), Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13750: Red Hat Enterprise Linux AppStream E4S (v.9.0), Red Hat Enterprise Linux BaseOS E4S (v.9.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10714: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9732: Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9415: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6462: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25096: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19724: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19725: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16008: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16030: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16009: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16174: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:5475: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10065: Red Hat Update Infrastructure 5"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-03-12T19:01:37.007Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-03-12T18:27:44.917Z",
            "value": "Made public."
          }
        ],
        "title": "openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this issue, disable GSSAPI key exchange in the OpenSSH server configuration. This prevents the server from processing GSSAPI messages, eliminating the vulnerability\u0027s attack surface.\n\nEdit `/etc/ssh/sshd_config` and add or modify the line:\n```\nGSSAPIKeyExchange no\n```\n\nAfter saving the changes, restart the `sshd` service for the mitigation to take effect. This action will prevent users from authenticating via GSSAPI.\n\n```\n# systemctl restart sshd\n```"
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:44:22.465Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://launchpad.net/ubuntu/",
          "defaultStatus": "unaffected",
          "packageName": "openssh",
          "product": "openssh",
          "repo": "https://launchpad.net/ubuntu/+source/openssh",
          "vendor": "Ubuntu",
          "versions": [
            {
              "lessThan": "1:10.0p1-5ubuntu5.1",
              "status": "affected",
              "version": "1:10.0p1-5ubuntu5",
              "versionType": "dpkg"
            },
            {
              "lessThan": "1:9.6p1-3ubuntu13.15",
              "status": "affected",
              "version": "1:9.6p1-3ubuntu13",
              "versionType": "dpkg"
            },
            {
              "lessThan": "1:8.9p1-3ubuntu0.14",
              "status": "affected",
              "version": "1:8.9p1-3",
              "versionType": "dpkg"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeremy Brown"
        }
      ],
      "datePublic": "2026-03-12T18:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "exploitMaturity": "UNREPORTED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-908",
              "description": "CWE-908 Use of Uninitialized Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-12T18:44:06.073Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://ubuntu.com/security/CVE-2026-3497"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/03/12/3"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2026-3497",
    "datePublished": "2026-03-12T18:27:44.917Z",
    "dateReserved": "2026-03-03T19:33:05.664Z",
    "dateUpdated": "2026-09-08T08:44:22.465Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-4424 (GCVE-0-2026-4424)

Vulnerability from cvelistv5 – Published: 2026-03-19 13:50 – Updated: 2026-09-01 12:04

Title

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-19 17:07 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

redhat redhat root

References

38 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:10065	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10097	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11768	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:12071	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:12274	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13812	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14773	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14937	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:15087	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16008	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16009	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16030	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16174	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17596	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19724	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19725	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20040	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21690	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25096	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8492	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8510	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8517	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8521	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8534	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8864	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8865	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8866	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8867	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8873	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8908	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8944	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9026	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9592	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9832	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-4424	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2449006	issue-trackingx_refsource_REDHAT
https://github.com/libarchive/libarchive/pull/2898
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex

Impacted products

66 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.7.7-8.el10_1 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:3.7.7-5.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.1.2-14.el7_9.2 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.3.3-7.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::crb cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:3.3.2-8.el8_2.2 , < * (rpm) cpe:/o:redhat:rhel_aus:8.2::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:3.3.3-1.el8_4.2 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:3.3.3-1.el8_4.2 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:3.3.3-6.el8_6.1 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:3.3.3-6.el8_6.1 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:3.3.3-6.el8_6.1 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:3.3.3-5.el8_8.2 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:3.3.3-5.el8_8.2 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.5.3-9.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:3.5.3-2.el9_0.4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0::appstream cpe:/o:redhat:rhel_e4s:9.0::baseos
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:3.5.3-5.el9_2.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::appstream cpe:/o:redhat:rhel_e4s:9.2::baseos
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:3.5.3-5.el9_4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4::appstream cpe:/a:redhat:rhel_eus:9.4::crb cpe:/o:redhat:rhel_eus:9.4::baseos
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:3.5.3-7.el9_6.1 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6::appstream cpe:/o:redhat:rhel_eus:9.6::baseos
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 412.86.202604281506-0 , < * (rpm) cpe:/a:redhat:openshift:4.12::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 413.92.202605271328-0 , < * (rpm) cpe:/a:redhat:openshift:4.13::el9
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 414.92.202605060243-0 , < * (rpm) cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 415.92.202605060220-0 , < * (rpm) cpe:/a:redhat:openshift:4.15::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 416.94.202604211449-0 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 417.94.202605112123-0 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 418.94.202604240015-0 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 4.19.9.6.202605201155-0 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325677 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325711 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325710 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-3.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325709 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325708 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1779223654 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1779223651 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1780681984 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244559 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244531 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778274666 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244546 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat Discovery 2	Unaffected: 1778101579 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Discovery 2	Unaffected: 1778156756 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Hardened Images	Unaffected: 3.8.7-1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Insights proxy 1.5	Unaffected: 1776868961 , < * (rpm) cpe:/a:redhat:insights_proxy:1.5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868774 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868744 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868772 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868842 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1777459441 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1777454300 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1777459504 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.3.3-7.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:3.3.2-8.el8_2.2 , < * (rpm) cpe:/o:redhat:rhel_aus:8.2
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:3.3.3-1.el8_4.2 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:3.3.3-1.el8_4.2 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:3.3.3-6.el8_6.1 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:3.3.3-6.el8_6.1 , < * (rpm) cpe:/o:redhat:rhel_tus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:3.3.3-6.el8_6.1 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:3.3.3-5.el8_8.2 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:3.3.3-5.el8_8.2 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.5.3-9.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:3.5.3-2.el9_0.4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:3.5.3-5.el9_2.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:3.5.3-5.el9_4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:3.5.3-7.el9_6.1 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6

Date Public

2026-03-19 00:00

Credits

Red Hat would like to thank Elhanan Haenel for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4424",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-19T17:07:05.672445Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T14:51:58.850Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.7.7-8.el10_1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.7.7-5.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.1.2-14.el7_9.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.3.3-7.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.2"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.3.2-8.el8_2.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.3.3-1.el8_4.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.3.3-1.el8_4.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.3.3-6.el8_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.3.3-6.el8_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.3.3-6.el8_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.3.3-5.el8_8.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.3.3-5.el8_8.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.5.3-9.el9_7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.0"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.5.3-2.el9_0.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.5.3-5.el9_2.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.5.3-5.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.5.3-7.el9_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "412.86.202604281506-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "413.92.202605271328-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "414.92.202605060243-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "415.92.202605060220-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "416.94.202604211449-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "417.94.202605112123-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "418.94.202604240015-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.19.9.6.202605201155-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-businesscentral-monitoring-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325677",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-businesscentral-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325711",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-controller-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325710",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-dashbuilder-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-3.1777325680",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-kieserver-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325709",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-process-migration-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325680",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-smartrouter-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325708",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779223654",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-rocm-rhel9",
            "product": "Red Hat AI Inference Server 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779223651",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/model-opt-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780681984",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/model-opt-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778244559",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-rocm-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778244531",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778274666",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-spyre-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778244546",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:discovery:2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "discovery/discovery-server-rhel9",
            "product": "Red Hat Discovery 2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778101579",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:discovery:2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "discovery/discovery-ui-rhel9",
            "product": "Red Hat Discovery 2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778156756",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "libarchive-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "3.8.7-1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:insights_proxy:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "insights-proxy/insights-proxy-container-rhel9",
            "product": "Red Hat Insights proxy 1.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776868961",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/cds-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776868774",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/haproxy-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776868744",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/installer-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776868772",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776868842",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/cds-kubernetes-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777459441",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/installer-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777454300",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777459504",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "libarchive",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-03-19T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T12:04:44.440Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-4424"
          },
          {
            "name": "RHBZ#2449006",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449006"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4424.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8517"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:12274"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13812"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21690"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:15087"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14773"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10097"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17596"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:12071"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:20040"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8865"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8492"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8867"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8864"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8873"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8866"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8510"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8534"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8521"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9592"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8908"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9026"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25096"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19724"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19725"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16008"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16030"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16009"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16174"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14937"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8944"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9832"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:11768"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10065"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:8517: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:12274: Red Hat OpenShift Container Platform 4.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13812: Middleware Containers for OpenShift"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21690: Red Hat OpenShift Container Platform 4.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:15087: Red Hat OpenShift Container Platform 4.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14773: Red Hat OpenShift Container Platform 4.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10097: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17596: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:12071: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:20040: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8865: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8492: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8867: Red Hat Enterprise Linux AppStream E4S (v.9.0), Red Hat Enterprise Linux BaseOS E4S (v.9.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8864: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8873: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8866: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8510: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8534: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8521: Red Hat Enterprise Linux BaseOS AUS (v. 8.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9592: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8908: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS E4S (v.8.6), Red Hat Enterprise Linux BaseOS TUS (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9026: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25096: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19724: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19725: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16008: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16030: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16009: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16174: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14937: Red Hat Discovery 2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8944: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9832: Red Hat Insights proxy 1.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:11768: Red Hat Update Infrastructure 5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10065: Red Hat Update Infrastructure 5"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-03-19T12:22:21.740Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-03-19T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.1"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.7.7-8.el10_1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux_eus:10.0"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.7.7-5.el10_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.2-14.el7_9.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::crb",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.3-7.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.2::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.2-8.el8_2.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.3-1.el8_4.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.3-1.el8_4.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.3-6.el8_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.3-6.el8_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.3-6.el8_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_e4s:8.8::baseos",
            "cpe:/o:redhat:rhel_tus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.3-5.el8_8.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_e4s:8.8::baseos",
            "cpe:/o:redhat:rhel_tus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.3-5.el8_8.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.5.3-9.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.5.3-9.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream",
            "cpe:/o:redhat:rhel_e4s:9.0::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.5.3-2.el9_0.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream",
            "cpe:/o:redhat:rhel_e4s:9.2::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.5.3-5.el9_2.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream",
            "cpe:/a:redhat:rhel_eus:9.4::crb",
            "cpe:/o:redhat:rhel_eus:9.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.5.3-5.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream",
            "cpe:/o:redhat:rhel_eus:9.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.5.3-7.el9_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.12::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.12",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "412.86.202604281506-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "413.92.202605271328-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "414.92.202605060243-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "415.92.202605060220-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "416.94.202604211449-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "417.94.202605112123-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "418.94.202604240015-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.19::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.19",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.19.9.6.202605201155-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-businesscentral-monitoring-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325677",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-businesscentral-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325711",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-controller-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325710",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-dashbuilder-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-3.1777325680",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-kieserver-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325709",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-process-migration-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325680",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-smartrouter-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325708",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-cuda-rhel9",
          "product": "Red Hat AI Inference Server 3.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1779223654",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-rocm-rhel9",
          "product": "Red Hat AI Inference Server 3.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1779223651",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/model-opt-cuda-rhel9",
          "product": "Red Hat AI Inference Server 3.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1780681984",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/model-opt-cuda-rhel9",
          "product": "Red Hat AI Inference Server 3.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778244559",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-rocm-rhel9",
          "product": "Red Hat AI Inference Server 3.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778244531",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-cuda-rhel9",
          "product": "Red Hat AI Inference Server 3.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778274666",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-spyre-rhel9",
          "product": "Red Hat AI Inference Server 3.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778244546",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "discovery/discovery-server-rhel9",
          "product": "Red Hat Discovery 2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778101579",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "discovery/discovery-ui-rhel9",
          "product": "Red Hat Discovery 2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778156756",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3.8.7-1.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:insights_proxy:1.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "insights-proxy/insights-proxy-container-rhel9",
          "product": "Red Hat Insights proxy 1.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1776868961",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/cds-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1776868774",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/haproxy-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1776868744",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/installer-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1776868772",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/rhua-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1776868842",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/cds-kubernetes-tp-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1777459441",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/installer-tp-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1777454300",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/rhua-tp-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1777459504",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Elhanan Haenel for reporting this issue."
        }
      ],
      "datePublic": "2026-03-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T16:55:09.454Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:10065",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "name": "RHSA-2026:10097",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:10097"
        },
        {
          "name": "RHSA-2026:11768",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11768"
        },
        {
          "name": "RHSA-2026:12071",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:12071"
        },
        {
          "name": "RHSA-2026:12274",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:12274"
        },
        {
          "name": "RHSA-2026:13812",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:13812"
        },
        {
          "name": "RHSA-2026:14773",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:14773"
        },
        {
          "name": "RHSA-2026:14937",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:14937"
        },
        {
          "name": "RHSA-2026:15087",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:15087"
        },
        {
          "name": "RHSA-2026:16008",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:16008"
        },
        {
          "name": "RHSA-2026:16009",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:16009"
        },
        {
          "name": "RHSA-2026:16030",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:16030"
        },
        {
          "name": "RHSA-2026:16174",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:16174"
        },
        {
          "name": "RHSA-2026:17596",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:17596"
        },
        {
          "name": "RHSA-2026:19724",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:19724"
        },
        {
          "name": "RHSA-2026:19725",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:19725"
        },
        {
          "name": "RHSA-2026:20040",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:20040"
        },
        {
          "name": "RHSA-2026:21690",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:21690"
        },
        {
          "name": "RHSA-2026:25096",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:25096"
        },
        {
          "name": "RHSA-2026:8492",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8492"
        },
        {
          "name": "RHSA-2026:8510",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8510"
        },
        {
          "name": "RHSA-2026:8517",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8517"
        },
        {
          "name": "RHSA-2026:8521",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8521"
        },
        {
          "name": "RHSA-2026:8534",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8534"
        },
        {
          "name": "RHSA-2026:8864",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8864"
        },
        {
          "name": "RHSA-2026:8865",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8865"
        },
        {
          "name": "RHSA-2026:8866",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8866"
        },
        {
          "name": "RHSA-2026:8867",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8867"
        },
        {
          "name": "RHSA-2026:8873",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8873"
        },
        {
          "name": "RHSA-2026:8908",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8908"
        },
        {
          "name": "RHSA-2026:8944",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8944"
        },
        {
          "name": "RHSA-2026:9026",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:9026"
        },
        {
          "name": "RHSA-2026:9592",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:9592"
        },
        {
          "name": "RHSA-2026:9832",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:9832"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-4424"
        },
        {
          "name": "RHBZ#2449006",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449006"
        },
        {
          "url": "https://github.com/libarchive/libarchive/pull/2898"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-19T12:22:21.740Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-03-19T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-4424",
    "datePublished": "2026-03-19T13:50:27.294Z",
    "dateReserved": "2026-03-19T12:23:38.191Z",
    "dateUpdated": "2026-09-01T12:04:44.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-4519 (GCVE-0-2026-4519)

Vulnerability from cvelistv5 – Published: 2026-03-20 15:08 – Updated: 2026-08-13 00:27

Title

webbrowser.open() allows leading dashes in URLs

Summary

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

Severity

7 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-25 14:30 UTC

CWE

CWE-20 - Improper Input Validation
CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

PSF mitre root

References

71 references

URL	Tags
https://github.com/python/cpython/pull/143931	patch
https://github.com/python/cpython/issues/143930	issue-tracking
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/43fe06b9…	patch
https://github.com/python/cpython/commit/82a24a44…	patch
https://github.com/python/cpython/commit/9669a912…	patch
https://github.com/python/cpython/commit/ad4d5ba3…	patch
https://github.com/python/cpython/commit/ceac1efc…	patch
https://github.com/python/cpython/commit/cbba6119…	patch
https://github.com/python/cpython/commit/3681d47a…	patch
https://github.com/python/cpython/commit/591ed890…	patch
https://github.com/python/cpython/commit/594b5a05…	patch
https://github.com/python/cpython/commit/89bfb8e5…	patch
https://github.com/python/cpython/commit/96fc5048…	patch
https://github.com/python/cpython/commit/cc023511…	patch
http://www.openwall.com/lists/oss-security/2026/03/20/1
https://access.redhat.com/security/cve/CVE-2026-4519	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2449649	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:10102	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9614	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9745	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13812	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7244	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6256	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19064	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19019	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6473	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6281	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6283	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9387	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9621	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9386	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9289	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9591	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9261	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9262	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9260	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10101	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9042	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10111	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9354	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9705	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7010	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6766	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6286	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6285	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19216	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19175	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19177	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19176	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25096	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7335	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19724	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19725	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16008	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8748	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8746	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16030	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8747	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16009	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16174	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7329	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10140	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10141	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6016	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6035	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7443	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7661	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21275	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10065	vendor-advisoryx_refsource_REDHAT

Impacted products

64 products

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.10.21 (python) Affected: 3.11.0 , < 3.11.16 (python) Affected: 3.12.0 , < 3.12.14 (python) Affected: 3.13.0 , < 3.13.13 (python) Affected: 3.14.0 , < 3.14.4 (python) Affected: 3.15.0a1 , < 3.15.0a8 (python)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.12.12-3.el10_1.2 , < * (rpm) Unaffected: 0:3.12.13-2.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1 cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.14.4-2.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:3.12.9-2.el10_0.8 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION	Unaffected: 0:2.6.6-70.el6_10.3 , < * (rpm) cpe:/o:redhat:rhel_els:6
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:2.7.5-94.el7_9.4 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.6.8-21.el7_9.5 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.11.13-6.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.12.12-4.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.6.8-75.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:3.6.8-24.el8_2.7 , < * (rpm) cpe:/a:redhat:rhel_aus:8.2
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:3.6.8-39.el8_4.10 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:3.6.8-39.el8_4.10 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:3.6.8-47.el8_6.12 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:3.6.8-47.el8_6.12 , < * (rpm) cpe:/a:redhat:rhel_tus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:3.6.8-47.el8_6.12 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:3.6.8-51.el8_8.14 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:3.11.2-2.el8_8.9 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:3.6.8-51.el8_8.14 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:3.11.2-2.el8_8.9 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.11.13-5.2.el9_7 , < * (rpm) Unaffected: 0:3.11.13-9.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.14.4-2.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.12.12-4.el9_7.2 , < * (rpm) Unaffected: 0:3.12.13-2.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.9.25-3.el9_7.2 , < * (rpm) Unaffected: 0:3.9.25-7.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:3.9.10-4.el9_0.10 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:3.11.2-2.el9_2.11 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:3.9.16-1.el9_2.13 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:3.9.18-3.el9_4.12 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:3.12.1-4.el9_4.12 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:3.11.7-1.el9_4.12 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:3.12.9-1.el9_6.7 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:3.9.21-2.el9_6.5 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:3.11.11-2.el9_6.6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325677 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325711 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325710 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-3.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325709 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325708 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1775740563 , < * (rpm) Unaffected: 1779223654 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1779223651 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1780681984 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1775749857 , < * (rpm) Unaffected: 1778244559 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1775680262 , < * (rpm) Unaffected: 1778244531 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1775680192 , < * (rpm) Unaffected: 1778274666 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244546 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat Discovery 2	Unaffected: 1775668717 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776871984 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776871985 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776872005 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776773390 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776871987 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776773505 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776938871 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Hardened Images	Unaffected: 3.11.15-2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 3.12.13-2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 3.13.13-1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 3.14.4-1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868774 , < * (rpm) Unaffected: 1779798159 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868744 , < * (rpm) Unaffected: 1779798164 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868772 , < * (rpm) Unaffected: 1779798165 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868842 , < * (rpm) Unaffected: 1779798222 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8

Credits

Seth Larson Gregory P. Smith an7y

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-20T20:07:08.244Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/20/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4519",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T14:30:47.809505Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T14:31:16.543Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1",
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.12-3.el10_1.2",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.13-2.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.14",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.14.4-2.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.9-2.el10_0.8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:6"
            ],
            "defaultStatus": "affected",
            "packageName": "python",
            "product": "Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.6.6-70.el6_10.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "python",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.7.5-94.el7_9.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-21.el7_9.5",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.13-6.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.12-4.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8",
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-75.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.2"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-24.el8_2.7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-39.el8_4.10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-39.el8_4.10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-47.el8_6.12",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-47.el8_6.12",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-47.el8_6.12",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-51.el8_8.14",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.2-2.el8_8.9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-51.el8_8.14",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.2-2.el8_8.9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.13-5.2.el9_7",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.13-9.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.14",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.14.4-2.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.12-4.el9_7.2",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.13-2.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.9",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.25-3.el9_7.2",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.25-7.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.0"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.9",
            "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.10-4.el9_0.10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.2-2.el9_2.11",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.9",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.16-1.el9_2.13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.9",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.18-3.el9_4.12",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.1-4.el9_4.12",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.7-1.el9_4.12",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.9-1.el9_6.7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.9",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.21-2.el9_6.5",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.11-2.el9_6.6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-businesscentral-monitoring-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325677",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-businesscentral-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325711",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-controller-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325710",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-dashbuilder-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-3.1777325680",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-kieserver-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325709",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-process-migration-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325680",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-smartrouter-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325708",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1775740563",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779223654",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-rocm-rhel9",
            "product": "Red Hat AI Inference Server 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779223651",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/model-opt-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780681984",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/model-opt-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1775749857",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778244559",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-rocm-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1775680262",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778244531",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1775680192",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778274666",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-spyre-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778244546",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:discovery:2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "discovery/discovery-server-rhel9",
            "product": "Red Hat Discovery 2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1775668717",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-aws-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776871984",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-azure-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776871985",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-azure-rocm-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776872005",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776773390",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-gcp-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776871987",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-rocm-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776773505",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/disk-image-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776938871",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "python3-11-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "3.11.15-2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "python3-12-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "3.12.13-2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "python3-13-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "3.13.13-1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "python3-14-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "3.14.4-1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/cds-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776868774",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779798159",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/haproxy-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776868744",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779798164",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/installer-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776868772",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779798165",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776868842",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779798222",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python36:3.6/python36",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python39-devel:3.9/python39",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-03-20T15:08:32.576Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-88",
                "description": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T00:52:50.058Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-4519"
          },
          {
            "name": "RHBZ#2449649",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4519.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10102"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9614"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9745"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13812"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7244"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6256"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19064"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19019"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6473"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6281"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6283"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9387"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9621"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9386"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9289"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9591"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9261"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9262"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9260"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10101"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9042"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10111"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9354"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9705"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7010"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6766"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6286"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6285"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19216"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19175"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19177"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19176"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25096"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7335"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19724"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19725"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16008"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8748"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8746"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16030"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8747"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16009"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16174"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7329"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10140"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10141"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6016"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6035"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7443"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7661"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21275"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10065"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:10102: Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION), Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9614: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9745: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13812: Middleware Containers for OpenShift"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7244: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6256: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19064: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19019: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6473: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6281: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6283: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9387: Red Hat Enterprise Linux AppStream AUS (v. 8.2), Red Hat Enterprise Linux BaseOS AUS (v. 8.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9621: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4), Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9386: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6), Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS E4S (v.8.6), Red Hat Enterprise Linux BaseOS TUS (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9289: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8), Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9591: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9261: Red Hat Enterprise Linux AppStream E4S (v.9.0), Red Hat Enterprise Linux BaseOS E4S (v.9.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9262: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9260: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10101: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9042: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10111: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9354: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9705: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7010: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6766: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6286: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6285: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19216: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19175: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19177: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19176: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25096: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7335: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19724: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19725: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16008: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8748: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8746: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16030: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8747: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16009: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16174: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7329: Red Hat Discovery 2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10140: Red Hat Enterprise Linux AI 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10141: Red Hat Enterprise Linux AI 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6016: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6035: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7443: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7661: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21275: Red Hat Update Infrastructure 5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10065: Red Hat Update Infrastructure 5"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-03-20T16:02:13.494Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-03-20T15:08:32.576Z",
            "value": "Made public."
          }
        ],
        "title": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "webbrowser"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.10.21",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.16",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.14",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.13",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.4",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0a8",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Seth Larson"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Gregory P. Smith"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "an7y"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The webbrowser.open() API would accept leading dashes in the URL which \ncould be handled as command line options for certain web browsers. New \nbehavior rejects leading dashes. Users are recommended to sanitize URLs \nprior to passing to webbrowser.open()."
            }
          ],
          "value": "The webbrowser.open() API would accept leading dashes in the URL which \ncould be handled as command line options for certain web browsers. New \nbehavior rejects leading dashes. Users are recommended to sanitize URLs \nprior to passing to webbrowser.open()."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T00:27:28.648Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/143931"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/143930"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "webbrowser.open() allows leading dashes in URLs",
      "x_generator": {
        "engine": "Vulnogram 0.6.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-4519",
    "datePublished": "2026-03-20T15:08:32.576Z",
    "dateReserved": "2026-03-20T15:01:11.126Z",
    "dateUpdated": "2026-08-13T00:27:28.648Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-4786 (GCVE-0-2026-4786)

Vulnerability from cvelistv5 – Published: 2026-04-13 21:52 – Updated: 2026-08-13 00:27

Title

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

Summary

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

Severity

7 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-14 13:43 UTC

CWE

CWE-77
CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

PSF mitre root

References

58 references

URL	Tags
https://github.com/python/cpython/pull/148170	patch
https://github.com/python/cpython/issues/148169	issue-tracking
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/c5767a72…	patch
https://github.com/python/cpython/commit/d22922c8…	patch
https://github.com/python/cpython/commit/f4654824…	patch
https://github.com/python/cpython/commit/28b4ad38…	patch
https://github.com/python/cpython/commit/d6d68494…	patch
https://github.com/python/cpython/commit/a4d3edf3…	patch
https://access.redhat.com/security/cve/CVE-2026-4786	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2458049	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:22144	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19589	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35838	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13812	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16699	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10711	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19064	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19019	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28581	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11077	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11062	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10950	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19590	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17619	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19549	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26187	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19571	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19570	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13692	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21682	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14653	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17525	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19576	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14652	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14656	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10949	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10774	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10745	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19216	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19175	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19177	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19176	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28247	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25096	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30078	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30089	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30088	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30087	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10140	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10141	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8822	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8824	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10117	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9228	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11768	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21275	vendor-advisoryx_refsource_REDHAT

Impacted products

63 products

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.10.21 (python) Affected: 3.11.0 , < 3.11.16 (python) Affected: 3.12.0 , < 3.12.14 (python) Affected: 3.13.0 , < 3.13.14 (python) Affected: 3.14.0a1 , < 3.14.5rc1 (python) Affected: 3.15.0a1 , < 3.15.0b1 (python)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.12.12-3.el10_1.3 , < * (rpm) Unaffected: 0:3.12.13-2.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1 cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.14.4-2.el10_2 , < * (rpm) Unaffected: 0:3.14.5-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:3.12.9-2.el10_0.9 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION	Unaffected: 0:2.6.6-70.el6_10.4 , < * (rpm) cpe:/o:redhat:rhel_els:6
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:2.7.5-94.el7_9.5 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.6.8-21.el7_9.6 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.12.13-2.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.11.13-7.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.6.8-76.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:3.6.8-39.el8_4.11 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:3.6.8-39.el8_4.11 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:3.6.8-47.el8_6.13 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:3.6.8-47.el8_6.13 , < * (rpm) cpe:/a:redhat:rhel_tus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:3.6.8-47.el8_6.13 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:3.6.8-51.el8_8.15 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:3.11.2-2.el8_8.10 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:3.6.8-51.el8_8.15 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:3.11.2-2.el8_8.10 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.12.12-4.el9_7.3 , < * (rpm) Unaffected: 0:3.12.13-2.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.11.13-5.3.el9_7 , < * (rpm) Unaffected: 0:3.11.13-9.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.9.25-3.el9_7.3 , < * (rpm) Unaffected: 0:3.9.25-7.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.14.4-2.el9_8 , < * (rpm) Unaffected: 0:3.14.5-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:3.9.10-4.el9_0.11 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:3.11.2-2.el9_2.12 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:3.9.16-1.el9_2.14 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:3.11.7-1.el9_4.13 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:3.12.1-4.el9_4.13 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:3.9.18-3.el9_4.13 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:3.11.11-2.el9_6.7 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:3.12.9-1.el9_6.8 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:3.9.21-2.el9_6.6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325677 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325711 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325710 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-3.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325709 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325708 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1780681984 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1782352950 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1782352919 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1782353093 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1782352847 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776871984 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776871985 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776872005 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776773390 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776871987 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776773505 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776938871 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Hardened Images	Unaffected: 3.13.13-1.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 3.11.15-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 3.12.13-3.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 3.14.4-2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1777459441 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1777454300 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1777459504 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1779798159 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1779798164 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1779798165 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1779798222 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8

Credits

an7y Seth Larson Stan Ulbrych

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4786",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-14T13:43:47.712946Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-14T13:43:54.704Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1",
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.12-3.el10_1.3",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.13-2.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.14",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.14.4-2.el10_2",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.14.5-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.9-2.el10_0.9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:6"
            ],
            "defaultStatus": "affected",
            "packageName": "python",
            "product": "Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.6.6-70.el6_10.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "python",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.7.5-94.el7_9.5",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-21.el7_9.6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.13-2.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.13-7.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8",
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-76.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-39.el8_4.11",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-39.el8_4.11",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-47.el8_6.13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-47.el8_6.13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-47.el8_6.13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-51.el8_8.15",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.2-2.el8_8.10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-51.el8_8.15",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.2-2.el8_8.10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.12-4.el9_7.3",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.13-2.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.13-5.3.el9_7",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.13-9.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.9",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.25-3.el9_7.3",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.25-7.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.14",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.14.4-2.el9_8",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.14.5-1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.0"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.9",
            "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.10-4.el9_0.11",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.2-2.el9_2.12",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.9",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.16-1.el9_2.14",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.7-1.el9_4.13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.1-4.el9_4.13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.9",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.18-3.el9_4.13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.11-2.el9_6.7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.9-1.el9_6.8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.9",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.21-2.el9_6.6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-businesscentral-monitoring-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325677",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-businesscentral-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325711",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-controller-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325710",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-dashbuilder-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-3.1777325680",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-kieserver-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325709",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-process-migration-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325680",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-smartrouter-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325708",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/model-opt-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780681984",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/model-opt-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782352950",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-spyre-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782352919",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-rocm-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782353093",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782352847",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-aws-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776871984",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-azure-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776871985",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-azure-rocm-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776872005",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776773390",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-gcp-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776871987",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-rocm-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776773505",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/disk-image-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776938871",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "python3-13-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "3.13.13-1.1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "python3-11-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "3.11.15-4.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "python3-12-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "3.12.13-3.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "python3-14-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "3.14.4-2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/cds-kubernetes-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777459441",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/installer-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777454300",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777459504",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/cds-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779798159",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/haproxy-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779798164",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/installer-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779798165",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779798222",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python2",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python36",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python36:3.6/python36",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "python38",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "python39",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-13T21:52:19.036Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Python webbrowser.open() API. If a specially crafted URL containing \"%action\" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-88",
                "description": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T00:48:45.183Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-4786"
          },
          {
            "name": "RHBZ#2458049",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4786.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22144"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19589"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35838"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13812"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16699"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10711"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19064"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19019"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28581"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:11077"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:11062"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10950"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19590"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17619"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19549"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26187"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19571"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19570"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13692"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21682"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14653"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17525"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19576"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14652"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14656"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10949"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10774"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10745"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19216"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19175"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19177"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19176"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28247"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25096"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30078"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30089"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30088"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30087"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10140"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10141"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8822"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8824"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10117"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9228"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:11768"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21275"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:22144: Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION), Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19589: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35838: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13812: Middleware Containers for OpenShift"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16699: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10711: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19064: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19019: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28581: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:11077: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:11062: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10950: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19590: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4), Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17619: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6), Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS E4S (v.8.6), Red Hat Enterprise Linux BaseOS TUS (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19549: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8), Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26187: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19571: Red Hat Enterprise Linux AppStream E4S (v.9.0), Red Hat Enterprise Linux BaseOS E4S (v.9.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19570: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13692: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21682: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14653: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17525: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19576: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14652: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14656: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10949: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10774: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10745: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19216: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19175: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19177: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19176: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28247: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25096: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30078: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30089: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30088: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30087: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10140: Red Hat Enterprise Linux AI 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10141: Red Hat Enterprise Linux AI 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8822: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8824: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10117: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9228: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:11768: Red Hat Update Infrastructure 5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21275: Red Hat Update Infrastructure 5"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-13T22:01:38.006Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-13T21:52:19.036Z",
            "value": "Made public."
          }
        ],
        "title": "python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.10.21",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.16",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.14",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.14",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.5rc1",
              "status": "affected",
              "version": "3.14.0a1",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0b1",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "an7y"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Seth Larson"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Stan Ulbrych"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "type": "text/html",
              "value": "Mitgation of\u0026nbsp;CVE-2026-4519 was incomplete. If the URL contained \"%action\" the mitigation could be bypassed for certain browser types the \"webbrowser.open()\" API could have commands injected into the underlying shell. See\u0026nbsp;CVE-2026-4519 for details."
            }
          ],
          "value": "Mitgation of\u00a0CVE-2026-4519 was incomplete. If the URL contained \"%action\" the mitigation could be bypassed for certain browser types the \"webbrowser.open()\" API could have commands injected into the underlying shell. See\u00a0CVE-2026-4519 for details."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T00:27:20.638Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/148170"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/148169"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/c5767a72838a8dda9d6dc5d3558075b055c56bca"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/d22922c8a7958353689dc4763dd72da2dea03fff"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/f4654824ae0850ac87227fb270f9057477946769"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/28b4ad38067bbdad34edfcd03ad2de5f06387e53"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/d6d68494be70bdbda20f89f83801ba52ec37daa4"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/a4d3edf3a6ecfde504d02126410d2a65a859b744"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-4786",
    "datePublished": "2026-04-13T21:52:19.036Z",
    "dateReserved": "2026-03-24T19:25:48.269Z",
    "dateUpdated": "2026-08-13T00:27:20.638Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-5121 (GCVE-0-2026-5121)

Vulnerability from cvelistv5 – Published: 2026-03-30 07:47 – Updated: 2026-09-01 08:38

Title

Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-31 03:55 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

redhat redhat root

References

37 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:10065	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10097	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11768	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:12071	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:12274	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13812	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14773	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14937	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:15087	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16008	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16009	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16030	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16174	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17596	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19724	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19725	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20040	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21690	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25096	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8510	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8517	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8521	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8534	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8864	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8866	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8867	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8873	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8908	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8944	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9026	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9592	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9832	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-5121	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2452945	issue-trackingx_refsource_REDHAT
https://github.com/advisories/GHSA-2vwv-vqpv-v8vc
https://github.com/libarchive/libarchive/pull/2934
https://cert-portal.siemens.com/productcert/html/…

Impacted products

51 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.1.2-14.el7_9.2 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.3.3-7.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::crb cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:3.3.2-8.el8_2.2 , < * (rpm) cpe:/o:redhat:rhel_aus:8.2::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:3.3.3-1.el8_4.2 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:3.3.3-1.el8_4.2 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:3.3.3-6.el8_6.1 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:3.3.3-6.el8_6.1 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:3.3.3-6.el8_6.1 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:3.3.3-5.el8_8.2 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:3.3.3-5.el8_8.2 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.5.3-9.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:3.5.3-2.el9_0.4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0::appstream cpe:/o:redhat:rhel_e4s:9.0::baseos
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:3.5.3-5.el9_2.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::appstream cpe:/o:redhat:rhel_e4s:9.2::baseos
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:3.5.3-5.el9_4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4::appstream cpe:/a:redhat:rhel_eus:9.4::crb cpe:/o:redhat:rhel_eus:9.4::baseos
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:3.5.3-7.el9_6.1 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6::appstream cpe:/o:redhat:rhel_eus:9.6::baseos
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 412.86.202604281506-0 , < * (rpm) cpe:/a:redhat:openshift:4.12::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 413.92.202605271328-0 , < * (rpm) cpe:/a:redhat:openshift:4.13::el9
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 414.92.202605060243-0 , < * (rpm) cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 415.92.202605060220-0 , < * (rpm) cpe:/a:redhat:openshift:4.15::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 416.94.202604211449-0 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 417.94.202605112123-0 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 418.94.202604240015-0 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 4.19.9.6.202605201155-0 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325677 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325711 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325710 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-3.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325709 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325708 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1779223654 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1779223651 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1780681984 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244559 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244531 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778274666 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244546 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat Discovery 2	Unaffected: 1778156756 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Hardened Images	Unaffected: 3.8.7-1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Insights proxy 1.5	Unaffected: 1776868961 , < * (rpm) cpe:/a:redhat:insights_proxy:1.5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868774 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868744 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868772 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1776868842 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1777459441 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1777454300 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1777459504 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Siemens	SIDIS Secured SmartPlug	Affected: 0 , < V7.26.0310 (custom)

Date Public

2026-03-30 07:44

Credits

Red Hat would like to thank Elhanan Haenel for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-5121",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T03:55:34.402717Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T13:52:02.886Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIDIS Secured SmartPlug",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V7.26.0310",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:45:28.047Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-585531.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.2-14.el7_9.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::crb",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.3-7.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.2::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.2-8.el8_2.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.3-1.el8_4.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.3-1.el8_4.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.3-6.el8_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.3-6.el8_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.3-6.el8_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_e4s:8.8::baseos",
            "cpe:/o:redhat:rhel_tus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.3-5.el8_8.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_e4s:8.8::baseos",
            "cpe:/o:redhat:rhel_tus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.3.3-5.el8_8.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.5.3-9.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.5.3-9.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream",
            "cpe:/o:redhat:rhel_e4s:9.0::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.5.3-2.el9_0.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream",
            "cpe:/o:redhat:rhel_e4s:9.2::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.5.3-5.el9_2.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream",
            "cpe:/a:redhat:rhel_eus:9.4::crb",
            "cpe:/o:redhat:rhel_eus:9.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.5.3-5.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream",
            "cpe:/o:redhat:rhel_eus:9.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.5.3-7.el9_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.12::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.12",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "412.86.202604281506-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "413.92.202605271328-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "414.92.202605060243-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "415.92.202605060220-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "416.94.202604211449-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "417.94.202605112123-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "418.94.202604240015-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.19::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.19",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.19.9.6.202605201155-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-businesscentral-monitoring-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325677",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-businesscentral-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325711",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-controller-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325710",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-dashbuilder-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-3.1777325680",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-kieserver-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325709",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-process-migration-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325680",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhpam-7/rhpam-smartrouter-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.13.5-4.1777325708",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-cuda-rhel9",
          "product": "Red Hat AI Inference Server 3.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1779223654",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-rocm-rhel9",
          "product": "Red Hat AI Inference Server 3.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1779223651",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/model-opt-cuda-rhel9",
          "product": "Red Hat AI Inference Server 3.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1780681984",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/model-opt-cuda-rhel9",
          "product": "Red Hat AI Inference Server 3.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778244559",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-rocm-rhel9",
          "product": "Red Hat AI Inference Server 3.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778244531",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-cuda-rhel9",
          "product": "Red Hat AI Inference Server 3.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778274666",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-spyre-rhel9",
          "product": "Red Hat AI Inference Server 3.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778244546",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "discovery/discovery-ui-rhel9",
          "product": "Red Hat Discovery 2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778156756",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3.8.7-1.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:insights_proxy:1.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "insights-proxy/insights-proxy-container-rhel9",
          "product": "Red Hat Insights proxy 1.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1776868961",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/cds-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1776868774",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/haproxy-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1776868744",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/installer-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1776868772",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/rhua-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1776868842",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/cds-kubernetes-tp-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1777459441",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/installer-tp-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1777454300",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/rhua-tp-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1777459504",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unknown",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unknown",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Elhanan Haenel for reporting this issue."
        }
      ],
      "datePublic": "2026-03-30T07:44:15.222Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T08:38:36.825Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:10065",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "name": "RHSA-2026:10097",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:10097"
        },
        {
          "name": "RHSA-2026:11768",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11768"
        },
        {
          "name": "RHSA-2026:12071",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:12071"
        },
        {
          "name": "RHSA-2026:12274",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:12274"
        },
        {
          "name": "RHSA-2026:13812",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:13812"
        },
        {
          "name": "RHSA-2026:14773",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:14773"
        },
        {
          "name": "RHSA-2026:14937",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:14937"
        },
        {
          "name": "RHSA-2026:15087",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:15087"
        },
        {
          "name": "RHSA-2026:16008",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:16008"
        },
        {
          "name": "RHSA-2026:16009",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:16009"
        },
        {
          "name": "RHSA-2026:16030",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:16030"
        },
        {
          "name": "RHSA-2026:16174",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:16174"
        },
        {
          "name": "RHSA-2026:17596",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:17596"
        },
        {
          "name": "RHSA-2026:19724",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:19724"
        },
        {
          "name": "RHSA-2026:19725",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:19725"
        },
        {
          "name": "RHSA-2026:20040",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:20040"
        },
        {
          "name": "RHSA-2026:21690",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:21690"
        },
        {
          "name": "RHSA-2026:25096",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:25096"
        },
        {
          "name": "RHSA-2026:8510",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8510"
        },
        {
          "name": "RHSA-2026:8517",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8517"
        },
        {
          "name": "RHSA-2026:8521",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8521"
        },
        {
          "name": "RHSA-2026:8534",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8534"
        },
        {
          "name": "RHSA-2026:8864",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8864"
        },
        {
          "name": "RHSA-2026:8866",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8866"
        },
        {
          "name": "RHSA-2026:8867",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8867"
        },
        {
          "name": "RHSA-2026:8873",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8873"
        },
        {
          "name": "RHSA-2026:8908",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8908"
        },
        {
          "name": "RHSA-2026:8944",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:8944"
        },
        {
          "name": "RHSA-2026:9026",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:9026"
        },
        {
          "name": "RHSA-2026:9592",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:9592"
        },
        {
          "name": "RHSA-2026:9832",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:9832"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-5121"
        },
        {
          "name": "RHBZ#2452945",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452945"
        },
        {
          "url": "https://github.com/advisories/GHSA-2vwv-vqpv-v8vc"
        },
        {
          "url": "https://github.com/libarchive/libarchive/pull/2934"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-30T07:40:25.358Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-03-30T07:44:15.222Z",
          "value": "Made public."
        }
      ],
      "title": "Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this issue, avoid processing untrusted ISO9660 images with applications that utilize `libarchive`. Users should only extract or read content from ISO images obtained from trusted sources."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-5121",
    "datePublished": "2026-03-30T07:47:28.562Z",
    "dateReserved": "2026-03-30T07:39:27.352Z",
    "dateUpdated": "2026-09-01T08:38:36.825Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6100 (GCVE-0-2026-6100)

Vulnerability from cvelistv5 – Published: 2026-04-13 17:15 – Updated: 2026-08-13 00:27

Title

Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

Summary

Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-13 19:21 UTC

CWE

CWE-416 - Use after free
CWE-787 - Out-of-bounds write
CWE-825 - Expired Pointer Dereference

Assigner

PSF mitre root

References

55 references

URL	Tags
https://github.com/python/cpython/pull/148396	patch
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/issues/148395	issue-tracking
https://github.com/python/cpython/commit/6a5f79c8…	patch
https://github.com/python/cpython/commit/8fc66aef…	patch
https://github.com/python/cpython/commit/c3cf71c3…	patch
https://github.com/python/cpython/commit/47128e64…	patch
https://github.com/python/cpython/commit/e20c6c96…	patch
https://github.com/python/cpython/commit/ea8d735e…	patch
http://www.openwall.com/lists/oss-security/2026/0…
https://access.redhat.com/security/cve/CVE-2026-6100	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2457932	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:52400	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13812	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16699	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10711	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19064	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19019	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11077	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11062	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10950	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19590	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17619	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19549	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26187	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19571	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19570	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13692	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21682	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14653	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17525	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19576	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14652	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14656	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10949	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10774	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10745	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19216	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19175	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19177	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19176	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25096	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30078	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30089	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30088	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30087	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10140	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10141	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8822	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8824	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10117	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9228	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11768	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21275	vendor-advisoryx_refsource_REDHAT

Impacted products

63 products

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.10.21 (python) Affected: 3.11.0 , < 3.11.16 (python) Affected: 3.12.0 , < 3.12.14 (python) Affected: 3.13.0 , < 3.13.14 (python) Affected: 3.14.0a1 , < 3.14.5rc1 (python) Affected: 3.15.0a1 , < 3.15.0b1 (python)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.12.12-3.el10_1.3 , < * (rpm) Unaffected: 0:3.12.13-2.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1 cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.14.4-2.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:3.12.9-2.el10_0.9 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.12.13-2.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.11.13-7.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.6.8-76.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:3.6.8-39.el8_4.11 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:3.6.8-39.el8_4.11 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:3.6.8-47.el8_6.13 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:3.6.8-47.el8_6.13 , < * (rpm) cpe:/a:redhat:rhel_tus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:3.6.8-47.el8_6.13 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:3.6.8-51.el8_8.15 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:3.11.2-2.el8_8.10 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:3.6.8-51.el8_8.15 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:3.11.2-2.el8_8.10 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.12.12-4.el9_7.3 , < * (rpm) Unaffected: 0:3.12.13-2.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.11.13-5.3.el9_7 , < * (rpm) Unaffected: 0:3.11.13-9.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.9.25-3.el9_7.3 , < * (rpm) Unaffected: 0:3.9.25-7.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.14.4-2.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:3.9.10-4.el9_0.11 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:3.11.2-2.el9_2.12 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:3.9.16-1.el9_2.14 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:3.11.7-1.el9_4.13 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:3.12.1-4.el9_4.13 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:3.9.18-3.el9_4.13 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:3.11.11-2.el9_6.7 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:3.12.9-1.el9_6.8 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:3.9.21-2.el9_6.6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325677 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325711 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325710 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-3.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325709 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325680 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.13.5-4.1777325708 , < * (rpm) cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1780681984 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1782352950 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1782352919 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1782353093 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1782352847 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776871984 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776871985 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776872005 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776773390 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776871987 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776773505 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Enterprise Linux AI 3.3	Unaffected: 1776938871 , < * (rpm) cpe:/a:redhat:enterprise_linux_ai:3.3::el9
Red Hat	Red Hat Hardened Images	Unaffected: 3.13.13-1.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 3.11.15-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 3.12.13-3.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 3.14.4-2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1777459441 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1777454300 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1777459504 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1779798159 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1779798164 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1779798165 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1779798222 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	cpe:/a:redhat:enterprise_linux_ai:3

Credits

Ryan Hileman Stan Ulbrych Seth Larson Stan Ulbrych Ryan Hileman

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6100",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-13T19:21:03.412763Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-13T19:21:10.878Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-04-13T19:29:27.322Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/13/10"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1",
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.12-3.el10_1.3",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.13-2.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.14",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.14.4-2.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.9-2.el10_0.9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.13-2.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.13-7.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8",
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-76.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-39.el8_4.11",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-39.el8_4.11",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-47.el8_6.13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-47.el8_6.13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-47.el8_6.13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-51.el8_8.15",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.2-2.el8_8.10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.6.8-51.el8_8.15",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.2-2.el8_8.10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.12-4.el9_7.3",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.13-2.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.13-5.3.el9_7",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.13-9.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.9",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.25-3.el9_7.3",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.25-7.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.14",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.14.4-2.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.0"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.9",
            "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.10-4.el9_0.11",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.2-2.el9_2.12",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.9",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.16-1.el9_2.14",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.7-1.el9_4.13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.1-4.el9_4.13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.9",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.18-3.el9_4.13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.11",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.11.11-2.el9_6.7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.12.9-1.el9_6.8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.9",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.9.21-2.el9_6.6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-businesscentral-monitoring-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325677",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-businesscentral-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325711",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-controller-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325710",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-dashbuilder-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-3.1777325680",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-kieserver-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325709",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-process-migration-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325680",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhosemc:1.0::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhpam-7/rhpam-smartrouter-rhel8",
            "product": "RHEL-8 based Middleware Containers",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7.13.5-4.1777325708",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/model-opt-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780681984",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/model-opt-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782352950",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-spyre-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782352919",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-rocm-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782353093",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782352847",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-aws-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776871984",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-azure-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776871985",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-azure-rocm-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776872005",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776773390",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-gcp-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776871987",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-rocm-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776773505",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/disk-image-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776938871",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "python3-13-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "3.13.13-1.1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "python3-11-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "3.11.15-4.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "python3-12-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "3.12.13-3.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "python3-14-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "3.14.4-2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/cds-kubernetes-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777459441",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/installer-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777454300",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777459504",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/cds-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779798159",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/haproxy-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779798164",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/installer-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779798165",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779798222",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "python",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "python",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "python3",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python36:3.6/python36",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python39-devel:3.9/python39",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/bootc-cuda-aws-3-3",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/bootc-cuda-azure-3-3",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/bootc-cuda-gcp-3-3",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/bootc-rocm-azure-3-3",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-13T17:15:47.606Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Python\u0027s decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is experiencing high memory usage. Exploitation of this flaw could potentially allow an attacker to execute arbitrary code or access sensitive data. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-825",
                "description": "Expired Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T12:05:45.968Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-6100"
          },
          {
            "name": "RHBZ#2457932",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6100.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:52400"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13812"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16699"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10711"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19064"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19019"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:11077"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:11062"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10950"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19590"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17619"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19549"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26187"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19571"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19570"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13692"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21682"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14653"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17525"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19576"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14652"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14656"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10949"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10774"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10745"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19216"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19175"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19177"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19176"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25096"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30078"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30089"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30088"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30087"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10140"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10141"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8822"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8824"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10117"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9228"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:11768"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21275"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:52400: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13812: Middleware Containers for OpenShift"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16699: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10711: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19064: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19019: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:11077: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:11062: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10950: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19590: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4), Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17619: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6), Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS E4S (v.8.6), Red Hat Enterprise Linux BaseOS TUS (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19549: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8), Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26187: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19571: Red Hat Enterprise Linux AppStream E4S (v.9.0), Red Hat Enterprise Linux BaseOS E4S (v.9.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19570: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13692: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21682: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14653: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17525: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19576: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14652: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14656: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10949: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10774: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10745: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19216: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19175: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19177: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19176: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25096: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30078: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30089: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30088: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30087: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10140: Red Hat Enterprise Linux AI 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10141: Red Hat Enterprise Linux AI 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8822: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8824: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10117: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9228: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:11768: Red Hat Update Infrastructure 5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21275: Red Hat Update Infrastructure 5"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-13T18:01:31.970Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-13T17:15:47.606Z",
            "value": "Made public."
          }
        ],
        "title": "python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.10.21",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.16",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.14",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.14",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.5rc1",
              "status": "affected",
              "version": "3.14.0a1",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0b1",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ryan Hileman"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Stan Ulbrych"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Seth Larson"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Stan Ulbrych"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Ryan Hileman"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.\u003cbr\u003e\u003cbr\u003eThe vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable."
            }
          ],
          "value": "Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.\n\nThe vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use after free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T00:27:12.761Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/148396"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/148395"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure",
      "x_generator": {
        "engine": "Vulnogram 0.6.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-6100",
    "datePublished": "2026-04-13T17:15:47.606Z",
    "dateReserved": "2026-04-10T21:13:45.428Z",
    "dateUpdated": "2026-08-13T00:27:12.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:13812

CVE-2025-10158 (GCVE-0-2025-10158)

CVE-2025-14831 (GCVE-0-2025-14831)

CVE-2025-9820 (GCVE-0-2025-9820)

CVE-2026-27135 (GCVE-0-2026-27135)

CVE-2026-3497 (GCVE-0-2026-3497)

CVE-2026-4424 (GCVE-0-2026-4424)

CVE-2026-4519 (GCVE-0-2026-4519)

CVE-2026-4786 (GCVE-0-2026-4786)

CVE-2026-5121 (GCVE-0-2026-5121)

CVE-2026-6100 (GCVE-0-2026-6100)

Tags

Sightings

Nomenclature