RHSA-2026:5452

Vulnerability from csaf_redhat - Published: 2026-03-23 16:13 - Updated: 2026-03-26 20:46
Summary
Red Hat Security Advisory: RHTAS 1.3.3 - Red Hat Trusted Artifact Signer Release
Severity
Important
Notes
Topic: The 1.3.3 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3
Details: The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19, 4.20 and 4.21
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-61726

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Vendor Fix Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain. For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3 You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index https://access.redhat.com/errata/RHSA-2026:5452
Workaround Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
CVE-2025-61728

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Vendor Fix Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain. For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3 You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index https://access.redhat.com/errata/RHSA-2026:5452
Workaround To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.
CVE-2025-68121

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Vendor Fix Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain. For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3 You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index https://access.redhat.com/errata/RHSA-2026:5452
References
https://access.redhat.com/errata/RHSA-2026:5452 self
https://access.redhat.com/documentation/en-us/red… external
https://access.redhat.com/documentation/en-us/red… external
https://access.redhat.com/security/cve/CVE-2025-61726 external
https://access.redhat.com/security/cve/CVE-2025-61728 external
https://access.redhat.com/security/cve/CVE-2025-68121 external
https://access.redhat.com/security/updates/classi… external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2025-61726 self
https://bugzilla.redhat.com/show_bug.cgi?id=2434432 external
https://www.cve.org/CVERecord?id=CVE-2025-61726 external
https://nvd.nist.gov/vuln/detail/CVE-2025-61726 external
https://go.dev/cl/736712 external
https://go.dev/issue/77101 external
https://groups.google.com/g/golang-announce/c/Vd2… external
https://pkg.go.dev/vuln/GO-2026-4341 external
https://access.redhat.com/security/cve/CVE-2025-61728 self
https://bugzilla.redhat.com/show_bug.cgi?id=2434431 external
https://www.cve.org/CVERecord?id=CVE-2025-61728 external
https://nvd.nist.gov/vuln/detail/CVE-2025-61728 external
https://go.dev/cl/736713 external
https://go.dev/issue/77102 external
https://pkg.go.dev/vuln/GO-2026-4342 external
https://access.redhat.com/security/cve/CVE-2025-68121 self
https://bugzilla.redhat.com/show_bug.cgi?id=2437111 external
https://www.cve.org/CVERecord?id=CVE-2025-68121 external
https://nvd.nist.gov/vuln/detail/CVE-2025-68121 external
https://go.dev/cl/737700 external
https://go.dev/issue/77217 external
https://groups.google.com/g/golang-announce/c/K09… external
https://pkg.go.dev/vuln/GO-2026-4337 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The 1.3.3 release of Red Hat Trusted Artifact Signer OpenShift Operator.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19, 4.20 and 4.21",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:5452",
        "url": "https://access.redhat.com/errata/RHSA-2026:5452"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61726",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61726"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61728",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61728"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-68121",
        "url": "https://access.redhat.com/security/cve/CVE-2025-68121"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5452.json"
      }
    ],
    "title": "Red Hat Security Advisory: RHTAS 1.3.3 - Red Hat Trusted Artifact Signer Release",
    "tracking": {
      "current_release_date": "2026-03-26T20:46:12+00:00",
      "generator": {
        "date": "2026-03-26T20:46:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.4"
        }
      },
      "id": "RHSA-2026:5452",
      "initial_release_date": "2026-03-23T16:13:04+00:00",
      "revision_history": [
        {
          "date": "2026-03-23T16:13:04+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-03-23T16:13:12+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-03-26T20:46:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Trusted Artifact Signer 1.3",
                "product": {
                  "name": "Red Hat Trusted Artifact Signer 1.3",
                  "product_id": "Red Hat Trusted Artifact Signer 1.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Trusted Artifact Signer"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64",
                  "product_id": "registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cosign-rhel9@sha256%3Afab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1773309219"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64",
                  "product_id": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fetch-tsa-certs-rhel9@sha256%3A109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1773307765"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64",
                  "product_id": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/gitsign-rhel9@sha256%3A582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1773307743"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64",
                  "product_id": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rekor-cli-rhel9@sha256%3Ad50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1773307592"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64",
                  "product_id": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/updatetree-rhel9@sha256%3Abcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1773231678"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-61726",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-01-28T20:01:42.791305+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2434432"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "RHBZ#2434432",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/736712",
          "url": "https://go.dev/cl/736712"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77101",
          "url": "https://go.dev/issue/77101"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4341",
          "url": "https://pkg.go.dev/vuln/GO-2026-4341"
        }
      ],
      "release_date": "2026-01-28T19:30:31.215000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-23T16:13:04+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5452"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "cve": "CVE-2025-61728",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-01-28T20:01:39.965024+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2434431"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker needs to be able to process a malicious zip archive with an application using the archive/zip package. Additionally, this vulnerability can cause a Go application to consume an excessive amount of CPU and memory, eventually resulting in a denial of service with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61728"
        },
        {
          "category": "external",
          "summary": "RHBZ#2434431",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61728",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61728"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/736713",
          "url": "https://go.dev/cl/736713"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77102",
          "url": "https://go.dev/issue/77102"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4342",
          "url": "https://pkg.go.dev/vuln/GO-2026-4342"
        }
      ],
      "release_date": "2026-01-28T19:30:31.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-23T16:13:04+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5452"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip"
    },
    {
      "cve": "CVE-2025-68121",
      "discovery_date": "2026-02-05T18:01:30.086058+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2437111"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: Unexpected session resumption in crypto/tls",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "RHBZ#2437111",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/737700",
          "url": "https://go.dev/cl/737700"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77217",
          "url": "https://go.dev/issue/77217"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
          "url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4337",
          "url": "https://pkg.go.dev/vuln/GO-2026-4337"
        }
      ],
      "release_date": "2026-02-05T17:48:44.141000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-23T16:13:04+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5452"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/cosign-rhel9@sha256:fab56b9624ac2348e7fef16cda18f48777f76909d93a505db62717a74d9a7c9d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:109fc1b1ce669c144798adc1e09017ced12f36907b4da50c7cc0deb15993e844_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/gitsign-rhel9@sha256:582d9239bbfcad86a6927c9f69b01d8738c0f268aec9d0b00d913f2071f11a28_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:d50cee3044eca6e7ce7bba7d72f9baba10a2ada5cd448bd293cb96a8c47a1eb4_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/updatetree-rhel9@sha256:bcd31780ad6c923dabd76e26a8550b5eb975e3beb94d56f986eb14fa37b23cff_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/tls: Unexpected session resumption in crypto/tls"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.