Vulnerability-Lookup

RHSA-2026:5606

Vulnerability from csaf_redhat - Published: 2026-03-24 10:00 - Updated: 2026-03-25 04:59

Summary

Red Hat Security Advisory: Red Hat Ceph Storage

Severity

Important

Notes

Topic: A new version of Red Hat build of Ceph Storage has been released

Details: The Red Hat Storage Ceph container images are based on the latest ubi9 base image and Ceph 8.1. This release updates to the latest version.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-9820

A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.

4.0 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-121 - Stack-based Buffer Overflow

Vendor Fix The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. https://access.redhat.com/errata/RHSA-2026:5606

Workaround Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Applying the upstream patch or vendor-supplied security update is the recommended resolution.

CVE-2025-12801

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-279 - Incorrect Execution-Assigned Permissions

Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

CVE-2025-14831

A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-407 - Inefficient Algorithmic Complexity

CVE-2025-15281

A flaw was found in glibc. When the wordexp function is called with the flags WRDE_REUSE and WRDE_APPEND, it may return uninitialized memory. If the caller inspects the we_wordv array or calls the wordfree function to free the allocated memory, the process will abort, resulting in a denial of service.

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-908 - Use of Uninitialized Resource

Workaround To mitigate this issue, consider refactoring the use of the wordexp function to not use the WRDE_REUSE and WRDE_APPEND flags together.

CVE-2025-15366

A flaw was found in the imaplib module in the Python standard library. The imaplib module does not reject control characters, such as newlines, in user-controlled input passed to IMAP commands. This issue allows an attacker to inject additional commands to be executed in the IMAP server.

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Workaround To mitigate this vulnerability, ensure that no data passed to the imaplib module contains newline or carriage return characters.

CVE-2025-15367

A flaw was found in the poplib module in the Python standard library. The poplib module does not reject control characters, such as newlines, in user-controlled input passed to POP3 commands. This issue allows an attacker to inject additional commands to be executed in the POP3 server.

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Workaround To mitigate this vulnerability, ensure that no data passed to the poplib module contains newline or carriage return characters.

CVE-2026-0861

A flaw was found in the glibc library. Passing an excessively large alignment value to the memalign suite of functions, such as memalign, posix_memalign, aligned_alloc, valloc and pvalloc, an integer overflow can occur during internal size calculations due to improper overflow checks, causing an allocation of a small chunk of memory which is subsequently used for writing. This issue can result in an application crash or heap memory corruption.

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-190 - Integer Overflow or Wraparound

Workaround Applications calling one of the vulnerable functions and allowing the alignment parameter to be set by user-controlled input can implement additional validations checks, ensuring the alignment value is a power of two and does not exceed a sane limit, for example the system page size or a maximum of 64KB. This prevents the excessively large value required to trigger the integer overflow.

CVE-2026-0865

Missing newline filtering has been discovered in Python. User-controlled header names and values containing newlines can allow injecting HTTP headers.

4.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVE-2026-0915

A flaw was found in glibc, the GNU C Library. When an application calls the `getnetbyaddr` or `getnetbyaddr_r` functions to resolve a network address, and the system's `nsswitch.conf` file is configured to use a DNS (Domain Name System) backend for network lookups, a query for a zero-valued network can lead to the disclosure of stack memory contents. This information is leaked to the configured DNS resolver, potentially allowing an attacker who controls the resolver to gain sensitive data from the affected system.

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-908 - Use of Uninitialized Resource

CVE-2026-1299

A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules, allowing an attacker to inject email headers and potentially modify message recipients or the email body, and spoof sender information.

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Workaround To mitigate this issue, applications accepting user-supplied data for email headers should sanitize the input by stripping or rejecting any strings containing carriage return or line feed characters, '\r' or '\n', respectively, preventing malicious sequences that could lead to header manipulation.

CVE-2026-22695

A flaw was found in libpng, a reference library for processing PNG (Portable Network Graphics) image files. A local attacker could exploit a heap buffer over-read vulnerability in the `png_image_finish_read` function by tricking a user into processing a specially crafted interlaced 16-bit PNG file with an 8-bit output format and non-minimal row stride. This could lead to a denial of service (DoS) and potentially information disclosure.

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

CWE-125 - Out-of-bounds Read

Workaround To mitigate this issue, users should avoid opening untrusted PNG image files. Applications that process PNG images should be configured to restrict processing of untrusted or unverified content where possible.

CVE-2026-22801

A flaw was found in libpng, a reference library for PNG (Portable Network Graphics) raster image files. An integer truncation vulnerability exists in the png_write_image_16bit and png_write_image_8bit simplified write API functions. A local attacker could exploit this flaw by providing a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes, leading to a heap buffer over-read. This can result in information disclosure or a denial of service (DoS) to the system.

6.6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

CWE-125 - Out-of-bounds Read

CVE-2026-23490

A flaw was found in pyasn1, a generic ASN.1 library for Python. A remote attacker could exploit this vulnerability by sending a specially crafted RELATIVE-OID with excessive continuation octets. This input validation vulnerability leads to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

CVE-2026-25646

A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification.

7.0 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

CWE-125 - Out-of-bounds Read

References

URL

Category

	https://access.redhat.com/errata/RHSA-2026:5606	self
	https://access.redhat.com/security/cve/CVE-2025-12801	external
	https://access.redhat.com/security/cve/CVE-2025-14831	external
	https://access.redhat.com/security/cve/CVE-2025-15281	external
	https://access.redhat.com/security/cve/CVE-2025-15366	external
	https://access.redhat.com/security/cve/CVE-2025-15367	external
	https://access.redhat.com/security/cve/CVE-2025-9820	external
	https://access.redhat.com/security/cve/CVE-2026-0861	external
	https://access.redhat.com/security/cve/CVE-2026-0865	external
	https://access.redhat.com/security/cve/CVE-2026-0915	external
	https://access.redhat.com/security/cve/CVE-2026-1299	external
	https://access.redhat.com/security/cve/CVE-2026-22695	external
	https://access.redhat.com/security/cve/CVE-2026-22801	external
	https://access.redhat.com/security/cve/CVE-2026-23490	external
	https://access.redhat.com/security/cve/CVE-2026-25646	external
	https://access.redhat.com/security/updates/classi…	external
	https://docs.redhat.com/en/documentation/red_hat_…	external
	https://security.access.redhat.com/data/csaf/v2/a…	self
	https://access.redhat.com/security/cve/CVE-2025-9820	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2392528	external
	https://www.cve.org/CVERecord?id=CVE-2025-9820	external
	https://nvd.nist.gov/vuln/detail/CVE-2025-9820	external
	https://gitlab.com/gnutls/gnutls/-/commit/1d56f96…	external
	https://gitlab.com/gnutls/gnutls/-/issues/1732	external
	https://www.gnutls.org/security-new.html#GNUTLS-S…	external
	https://access.redhat.com/security/cve/CVE-2025-12801	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2413081	external
	https://www.cve.org/CVERecord?id=CVE-2025-12801	external
	https://nvd.nist.gov/vuln/detail/CVE-2025-12801	external
	https://access.redhat.com/security/cve/CVE-2025-14831	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2423177	external
	https://www.cve.org/CVERecord?id=CVE-2025-14831	external
	https://nvd.nist.gov/vuln/detail/CVE-2025-14831	external
	https://gitlab.com/gnutls/gnutls/-/issues/1773	external
	https://access.redhat.com/security/cve/CVE-2025-15281	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2431196	external
	https://www.cve.org/CVERecord?id=CVE-2025-15281	external
	https://nvd.nist.gov/vuln/detail/CVE-2025-15281	external
	https://sourceware.org/bugzilla/show_bug.cgi?id=33814	external
	https://access.redhat.com/security/cve/CVE-2025-15366	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2431368	external
	https://www.cve.org/CVERecord?id=CVE-2025-15366	external
	https://nvd.nist.gov/vuln/detail/CVE-2025-15366	external
	https://github.com/python/cpython/issues/143921	external
	https://github.com/python/cpython/pull/143922	external
	https://mail.python.org/archives/list/security-an…	external
	https://access.redhat.com/security/cve/CVE-2025-15367	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2431373	external
	https://www.cve.org/CVERecord?id=CVE-2025-15367	external
	https://nvd.nist.gov/vuln/detail/CVE-2025-15367	external
	https://github.com/python/cpython/issues/143923	external
	https://github.com/python/cpython/pull/143924	external
	https://mail.python.org/archives/list/security-an…	external
	https://access.redhat.com/security/cve/CVE-2026-0861	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2429771	external
	https://www.cve.org/CVERecord?id=CVE-2026-0861	external
	https://nvd.nist.gov/vuln/detail/CVE-2026-0861	external
	https://sourceware.org/bugzilla/show_bug.cgi?id=33796	external
	https://access.redhat.com/security/cve/CVE-2026-0865	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2431367	external
	https://www.cve.org/CVERecord?id=CVE-2026-0865	external
	https://nvd.nist.gov/vuln/detail/CVE-2026-0865	external
	https://github.com/python/cpython/issues/143916	external
	https://github.com/python/cpython/pull/143917	external
	https://mail.python.org/archives/list/security-an…	external
	https://access.redhat.com/security/cve/CVE-2026-0915	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2430201	external
	https://www.cve.org/CVERecord?id=CVE-2026-0915	external
	https://nvd.nist.gov/vuln/detail/CVE-2026-0915	external
	https://sourceware.org/bugzilla/show_bug.cgi?id=33802	external
	https://access.redhat.com/security/cve/CVE-2026-1299	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2432437	external
	https://www.cve.org/CVERecord?id=CVE-2026-1299	external
	https://nvd.nist.gov/vuln/detail/CVE-2026-1299	external
	https://cve.org/CVERecord?id=CVE-2024-6923	external
	https://github.com/python/cpython/commit/052e55e7…	external
	https://github.com/python/cpython/issues/144125	external
	https://github.com/python/cpython/pull/144126	external
	https://mail.python.org/archives/list/security-an…	external
	https://access.redhat.com/security/cve/CVE-2026-22695	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2428825	external
	https://www.cve.org/CVERecord?id=CVE-2026-22695	external
	https://nvd.nist.gov/vuln/detail/CVE-2026-22695	external
	https://github.com/pnggroup/libpng/commit/218612d…	external
	https://github.com/pnggroup/libpng/commit/e4f7ad4ea2	external
	https://github.com/pnggroup/libpng/issues/778	external
	https://github.com/pnggroup/libpng/security/advis…	external
	https://access.redhat.com/security/cve/CVE-2026-22801	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2428824	external
	https://www.cve.org/CVERecord?id=CVE-2026-22801	external
	https://nvd.nist.gov/vuln/detail/CVE-2026-22801	external
	https://github.com/pnggroup/libpng/security/advis…	external
	https://access.redhat.com/security/cve/CVE-2026-23490	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2430472	external
	https://www.cve.org/CVERecord?id=CVE-2026-23490	external
	https://nvd.nist.gov/vuln/detail/CVE-2026-23490	external
	https://github.com/pyasn1/pyasn1/commit/3908f1442…	external
	https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2	external
	https://github.com/pyasn1/pyasn1/security/advisor…	external
	https://access.redhat.com/security/cve/CVE-2026-25646	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2438542	external
	https://www.cve.org/CVERecord?id=CVE-2026-25646	external
	https://nvd.nist.gov/vuln/detail/CVE-2026-25646	external
	http://www.openwall.com/lists/oss-security/2026/02/09/7	external
	https://github.com/pnggroup/libpng/commit/01d03b8…	external
	https://github.com/pnggroup/libpng/security/advis…	external

Acknowledgments

Simon Hall

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new version of Red Hat build of Ceph Storage has been released",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Red Hat Storage Ceph container images are based on the latest ubi9 base image and Ceph 8.1.\nThis release updates to the latest version.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:5606",
        "url": "https://access.redhat.com/errata/RHSA-2026:5606"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-12801",
        "url": "https://access.redhat.com/security/cve/CVE-2025-12801"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-14831",
        "url": "https://access.redhat.com/security/cve/CVE-2025-14831"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-15281",
        "url": "https://access.redhat.com/security/cve/CVE-2025-15281"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-15366",
        "url": "https://access.redhat.com/security/cve/CVE-2025-15366"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-15367",
        "url": "https://access.redhat.com/security/cve/CVE-2025-15367"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-9820",
        "url": "https://access.redhat.com/security/cve/CVE-2025-9820"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-0861",
        "url": "https://access.redhat.com/security/cve/CVE-2026-0861"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-0865",
        "url": "https://access.redhat.com/security/cve/CVE-2026-0865"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-0915",
        "url": "https://access.redhat.com/security/cve/CVE-2026-0915"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-1299",
        "url": "https://access.redhat.com/security/cve/CVE-2026-1299"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-22695",
        "url": "https://access.redhat.com/security/cve/CVE-2026-22695"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-22801",
        "url": "https://access.redhat.com/security/cve/CVE-2026-22801"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-23490",
        "url": "https://access.redhat.com/security/cve/CVE-2026-23490"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-25646",
        "url": "https://access.redhat.com/security/cve/CVE-2026-25646"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_ceph_storage/",
        "url": "https://docs.redhat.com/en/documentation/red_hat_ceph_storage/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5606.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Ceph Storage",
    "tracking": {
      "current_release_date": "2026-03-25T04:59:29+00:00",
      "generator": {
        "date": "2026-03-25T04:59:29+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.3"
        }
      },
      "id": "RHSA-2026:5606",
      "initial_release_date": "2026-03-24T10:00:07+00:00",
      "revision_history": [
        {
          "date": "2026-03-24T10:00:07+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-03-24T10:00:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-03-25T04:59:29+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ceph Storage 8",
                "product": {
                  "name": "Red Hat Ceph Storage 8",
                  "product_id": "Red Hat Ceph Storage 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ceph_storage:8::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ceph Storage"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
                "product": {
                  "name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
                  "product_id": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhceph-8-rhel9@sha256%3A1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414?arch=amd64\u0026repository_url=registry.redhat.io/rhceph\u0026tag=1774002867"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le",
                  "product_id": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhceph-8-rhel9@sha256%3Aba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c?arch=ppc64le\u0026repository_url=registry.redhat.io/rhceph\u0026tag=1774002867"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
                "product": {
                  "name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
                  "product_id": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhceph-8-rhel9@sha256%3Aa0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1?arch=s390x\u0026repository_url=registry.redhat.io/rhceph\u0026tag=1774002867"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
                "product": {
                  "name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
                  "product_id": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhceph-8-rhel9@sha256%3A2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af?arch=arm64\u0026repository_url=registry.redhat.io/rhceph\u0026tag=1774002867"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64 as a component of Red Hat Ceph Storage 8",
          "product_id": "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64"
        },
        "product_reference": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
        "relates_to_product_reference": "Red Hat Ceph Storage 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64 as a component of Red Hat Ceph Storage 8",
          "product_id": "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64"
        },
        "product_reference": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
        "relates_to_product_reference": "Red Hat Ceph Storage 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x as a component of Red Hat Ceph Storage 8",
          "product_id": "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x"
        },
        "product_reference": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
        "relates_to_product_reference": "Red Hat Ceph Storage 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le as a component of Red Hat Ceph Storage 8",
          "product_id": "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le",
        "relates_to_product_reference": "Red Hat Ceph Storage 8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-9820",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "discovery_date": "2025-09-02T10:00:18.839000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2392528"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Low, since exploitation requires local access or a malicious PKCS#11 token. While the impact is limited to denial of service or potential code execution in constrained scenarios, the vulnerability stems from a lack of proper bounds checking during token label handling in GnuTLS. Users should treat this as a security concern in environments where untrusted tokens may be introduced.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-9820"
        },
        {
          "category": "external",
          "summary": "RHBZ#2392528",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392528"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-9820",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-9820"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9820",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9820"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/gnutls/gnutls/-/commit/1d56f96f6ab5034d677136b9d50b5a75dff0faf5",
          "url": "https://gitlab.com/gnutls/gnutls/-/commit/1d56f96f6ab5034d677136b9d50b5a75dff0faf5"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/gnutls/gnutls/-/issues/1732",
          "url": "https://gitlab.com/gnutls/gnutls/-/issues/1732"
        },
        {
          "category": "external",
          "summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18",
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18"
        }
      ],
      "release_date": "2025-11-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T10:00:07+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Applying the upstream patch or vendor-supplied security update is the recommended resolution.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Simon Hall"
          ]
        }
      ],
      "cve": "CVE-2025-12801",
      "cwe": {
        "id": "CWE-279",
        "name": "Incorrect Execution-Assigned Permissions"
      },
      "discovery_date": "2025-11-06T12:15:57.744000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2413081"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the\nprivileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any \u0027root_squash\u0027 or \u0027all_squash\u0027 attributes that would normally be expected to apply to that client.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nfs-utils: rpc.mountd in the nfs-utils privilege escalation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This MODERATE impact vulnerability in `rpc.mountd` within the `nfs-utils` package allows an authenticated NFSv3 client to bypass configured `root_squash` or `all_squash` restrictions. This enables the client to access subdirectories of an exported NFS share with elevated privileges, regardless of the intended file permissions. Red Hat Enterprise Linux systems configured as NFSv3 servers are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-12801"
        },
        {
          "category": "external",
          "summary": "RHBZ#2413081",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-12801",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-12801"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-12801",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12801"
        }
      ],
      "release_date": "2026-03-04T15:06:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T10:00:07+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nfs-utils: rpc.mountd in the nfs-utils privilege escalation"
    },
    {
      "cve": "CVE-2025-14831",
      "cwe": {
        "id": "CWE-407",
        "name": "Inefficient Algorithmic Complexity"
      },
      "discovery_date": "2025-12-17T14:48:30.222000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2423177"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat. GnuTLS is susceptible to a denial of service attack due to excessive CPU and memory consumption. This occurs when processing specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs) during certificate verification.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14831"
        },
        {
          "category": "external",
          "summary": "RHBZ#2423177",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423177"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14831",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14831"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14831",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14831"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/gnutls/gnutls/-/issues/1773",
          "url": "https://gitlab.com/gnutls/gnutls/-/issues/1773"
        }
      ],
      "release_date": "2026-02-09T14:26:34.939000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T10:00:07+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification"
    },
    {
      "cve": "CVE-2025-15281",
      "cwe": {
        "id": "CWE-908",
        "name": "Use of Uninitialized Resource"
      },
      "discovery_date": "2026-01-20T14:01:12.320264+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2431196"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in glibc. When the wordexp function is called with the flags WRDE_REUSE and WRDE_APPEND, it may return uninitialized memory. If the caller inspects the we_wordv array or calls the wordfree function to free the allocated memory, the process will abort, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs to find an application linked to the glibc library that is using the wordexp function with the flags WRDE_REUSE and WRDE_APPEND. Also, calls to wordexp using both flags never worked correctly and thus the existence of applications that make use of this feature is unlikely. There is no known application vulnerable to this issue.\n\nFurthermore, this flaw will result in a denial of service with no other security impact.\n\nDue to these reasons, this vulnerability has been rated with a low severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-15281"
        },
        {
          "category": "external",
          "summary": "RHBZ#2431196",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431196"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-15281",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-15281"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15281",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15281"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33814",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33814"
        }
      ],
      "release_date": "2026-01-20T13:22:46.495000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T10:00:07+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, consider refactoring the use of the wordexp function to not use the WRDE_REUSE and WRDE_APPEND flags together.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory"
    },
    {
      "cve": "CVE-2025-15366",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "discovery_date": "2026-01-20T22:01:33.257688+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2431368"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the imaplib module in the Python standard library. The imaplib module does not reject control characters, such as newlines, in user-controlled input passed to IMAP commands. This issue allows an attacker to inject additional commands to be executed in the IMAP server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cpython: IMAP command injection in user-controlled commands",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs to have the privileges required to send malicious input to an application that sends IMAP commands to a server. Additionally, this flaw can allow attackers to manipulate the state of the mailbox (e.g., delete emails, move folders, flag messages) and to potentially read metadata or specific email content, but it does not allow arbitrary code execution or OS command injection. Due to these reasons, this issue has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-15366"
        },
        {
          "category": "external",
          "summary": "RHBZ#2431368",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431368"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-15366",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-15366"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15366",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15366"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/143921",
          "url": "https://github.com/python/cpython/issues/143921"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/143922",
          "url": "https://github.com/python/cpython/pull/143922"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"
        }
      ],
      "release_date": "2026-01-20T21:40:24.938000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T10:00:07+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, ensure that no data passed to the imaplib module contains newline or carriage return characters.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cpython: IMAP command injection in user-controlled commands"
    },
    {
      "cve": "CVE-2025-15367",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "discovery_date": "2026-01-20T22:02:09.399038+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2431373"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the poplib module in the Python standard library. The poplib module does not reject control characters, such as newlines, in user-controlled input passed to POP3 commands. This issue allows an attacker to inject additional commands to be executed in the POP3 server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cpython: POP3 command injection in user-controlled commands",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs to have the privileges required to send malicious input to an application that sends POP3 commands to a server. Additionally, this flaw can allow attackers to manipulate the state of the mailbox (e.g., delete emails) and to potentially read metadata or specific email content, but it does not allow arbitrary code execution or OS command injection. Due to these reasons, this issue has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-15367"
        },
        {
          "category": "external",
          "summary": "RHBZ#2431373",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431373"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-15367",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-15367"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15367",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15367"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/143923",
          "url": "https://github.com/python/cpython/issues/143923"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/143924",
          "url": "https://github.com/python/cpython/pull/143924"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"
        }
      ],
      "release_date": "2026-01-20T21:47:09.885000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T10:00:07+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, ensure that no data passed to the poplib module contains newline or carriage return characters.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cpython: POP3 command injection in user-controlled commands"
    },
    {
      "cve": "CVE-2026-0861",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-01-14T22:01:10.975595+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2429771"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the glibc library. Passing an excessively large alignment value to the memalign suite of functions, such as memalign, posix_memalign, aligned_alloc, valloc and pvalloc, an integer overflow can occur during internal size calculations due to improper overflow checks, causing an allocation of a small chunk of memory which is subsequently used for writing. This issue can result in an application crash or heap memory corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "glibc: Integer overflow in memalign leads to heap corruption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker needs to find an application linked to the glibc library that is using one of the vulnerable functions (memalign, posix_memalign, aligned_alloc, valloc or pvalloc) in a way that the alignment parameter can be user-controlled, allowing an attacker to trigger the integer overflow. However, the alignment parameter used by the functions is usually hard-coded power of two and do not allow arbitrary values, specially values supplied by a user. There is no known application vulnerable to this issue.\n\nAlso, default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and memory protections significantly increase the difficult of achieving arbitrary code execution, limiting the impact of this vulnerability.\n\nDue to these reasons, this vulnerability has been rated with a low severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-0861"
        },
        {
          "category": "external",
          "summary": "RHBZ#2429771",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429771"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-0861",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0861"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0861",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0861"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33796",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33796"
        }
      ],
      "release_date": "2026-01-14T21:01:11.037000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T10:00:07+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "category": "workaround",
          "details": "Applications calling one of the vulnerable functions and allowing the alignment parameter to be set by user-controlled input can implement additional validations checks, ensuring the alignment value is a power of two and does not exceed a sane limit, for example the system page size or a maximum of 64KB. This prevents the excessively large value required to trigger the integer overflow.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "glibc: Integer overflow in memalign leads to heap corruption"
    },
    {
      "cve": "CVE-2026-0865",
      "cwe": {
        "id": "CWE-74",
        "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
      },
      "discovery_date": "2026-01-20T22:01:26.694713+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2431367"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Missing newline filtering has been discovered in Python. User-controlled header names and values containing newlines can allow injecting HTTP headers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cpython: wsgiref.headers.Headers allows header newline injection in Python",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-0865"
        },
        {
          "category": "external",
          "summary": "RHBZ#2431367",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431367"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-0865",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0865"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0865",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0865"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/143916",
          "url": "https://github.com/python/cpython/issues/143916"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/143917",
          "url": "https://github.com/python/cpython/pull/143917"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/"
        }
      ],
      "release_date": "2026-01-20T21:26:15.274000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T10:00:07+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cpython: wsgiref.headers.Headers allows header newline injection in Python"
    },
    {
      "cve": "CVE-2026-0915",
      "cwe": {
        "id": "CWE-908",
        "name": "Use of Uninitialized Resource"
      },
      "discovery_date": "2026-01-15T23:01:26.157678+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2430201"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in glibc, the GNU C Library. When an application calls the `getnetbyaddr` or `getnetbyaddr_r` functions to resolve a network address, and the system\u0027s `nsswitch.conf` file is configured to use a DNS (Domain Name System) backend for network lookups, a query for a zero-valued network can lead to the disclosure of stack memory contents. This information is leaked to the configured DNS resolver, potentially allowing an attacker who controls the resolver to gain sensitive data from the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "glibc: glibc: Information disclosure via zero-valued network query",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat products. It allows for information disclosure of stack contents to a configured DNS resolver when an application utilizes `getnetbyaddr` or `getnetbyaddr_r` with a DNS backend specified in `nsswitch.conf` for a zero-valued network query. This affects Red Hat Enterprise Linux and OpenShift Container Platform.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-0915"
        },
        {
          "category": "external",
          "summary": "RHBZ#2430201",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430201"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-0915",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0915"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0915",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0915"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33802",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33802"
        }
      ],
      "release_date": "2026-01-15T22:08:41.630000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T10:00:07+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "glibc: glibc: Information disclosure via zero-valued network query"
    },
    {
      "cve": "CVE-2026-1299",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2026-01-23T17:02:57.343486+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2432437"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules, allowing an attacker to inject email headers and potentially modify message recipients or the email body, and spoof sender information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cpython: email header injection due to unquoted newlines",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue can only be exploitable by Python applications using the LiteralHeader class to write email headers, as it does not respect email folding rules. Additionally, this issue allows attackers to modify message recipients or the email body and spoof sender identity but it does not cause memory corruption or arbitrary code execution. Due to these reasons, this vulnerability has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1299"
        },
        {
          "category": "external",
          "summary": "RHBZ#2432437",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432437"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1299",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1299"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1299",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1299"
        },
        {
          "category": "external",
          "summary": "https://cve.org/CVERecord?id=CVE-2024-6923",
          "url": "https://cve.org/CVERecord?id=CVE-2024-6923"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413",
          "url": "https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/144125",
          "url": "https://github.com/python/cpython/issues/144125"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/144126",
          "url": "https://github.com/python/cpython/pull/144126"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/"
        }
      ],
      "release_date": "2026-01-23T16:27:13.346000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T10:00:07+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications accepting user-supplied data for email headers should sanitize the input by stripping or rejecting any strings containing carriage return or line feed characters, \u0027\\r\u0027 or \u0027\\n\u0027, respectively, preventing malicious sequences that could lead to header manipulation.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cpython: email header injection due to unquoted newlines"
    },
    {
      "cve": "CVE-2026-22695",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-01-13T00:08:52.403246+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2428825"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libpng, a reference library for processing PNG (Portable Network Graphics) image files. A local attacker could exploit a heap buffer over-read vulnerability in the `png_image_finish_read` function by tricking a user into processing a specially crafted interlaced 16-bit PNG file with an 8-bit output format and non-minimal row stride. This could lead to a denial of service (DoS) and potentially information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat products. A heap buffer over-read flaw exists in the libpng library when processing specially crafted interlaced 16-bit PNG images with 8-bit output format and non-minimal row stride. This issue requires user interaction, as an attacker would need to trick a user into opening a malicious PNG file.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-22695"
        },
        {
          "category": "external",
          "summary": "RHBZ#2428825",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428825"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-22695",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-22695"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22695",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22695"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea",
          "url": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2",
          "url": "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/issues/778",
          "url": "https://github.com/pnggroup/libpng/issues/778"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp",
          "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp"
        }
      ],
      "release_date": "2026-01-12T22:55:40.204000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T10:00:07+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid opening untrusted PNG image files. Applications that process PNG images should be configured to restrict processing of untrusted or unverified content where possible.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read"
    },
    {
      "cve": "CVE-2026-22801",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-01-13T00:08:42.581146+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2428824"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libpng, a reference library for PNG (Portable Network Graphics) raster image files. An integer truncation vulnerability exists in the png_write_image_16bit and png_write_image_8bit simplified write API functions. A local attacker could exploit this flaw by providing a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes, leading to a heap buffer over-read. This can result in information disclosure or a denial of service (DoS) to the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat products. An integer truncation flaw in the libpng simplified write API functions (`png_write_image_16bit`, `png_write_image_8bit`) can lead to a heap buffer over-read. Exploitation requires an application to process specially crafted input that provides a negative row stride or a stride exceeding 65535 bytes, potentially resulting in denial of service or information disclosure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-22801"
        },
        {
          "category": "external",
          "summary": "RHBZ#2428824",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428824"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-22801",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-22801"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22801",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22801"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8",
          "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8"
        }
      ],
      "release_date": "2026-01-12T22:57:58.288000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T10:00:07+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API"
    },
    {
      "cve": "CVE-2026-23490",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-01-16T20:03:33.790513+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2430472"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pyasn1, a generic ASN.1 library for Python. A remote attacker could exploit this vulnerability by sending a specially crafted RELATIVE-OID with excessive continuation octets. This input validation vulnerability leads to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-23490"
        },
        {
          "category": "external",
          "summary": "RHBZ#2430472",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430472"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-23490",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-23490"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-23490",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23490"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970",
          "url": "https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2",
          "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq",
          "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq"
        }
      ],
      "release_date": "2026-01-16T19:03:36.442000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T10:00:07+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID"
    },
    {
      "cve": "CVE-2026-25646",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-02-10T18:01:28.232408+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2438542"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user\u0027s display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libpng: LIBPNG has a heap buffer overflow in png_set_quantize",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "For `java-17-openjdk-headless` and `java-21-openjdk-headless`, while the affected code is present in the bundled sources, it is not exercised by these headless packages.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
          "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25646"
        },
        {
          "category": "external",
          "summary": "RHBZ#2438542",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438542"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25646",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25646"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25646",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25646"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/02/09/7",
          "url": "http://www.openwall.com/lists/oss-security/2026/02/09/7"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88",
          "url": "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3",
          "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3"
        }
      ],
      "release_date": "2026-02-10T17:04:38.501000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T10:00:07+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x",
            "Red Hat Ceph Storage 8:registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libpng: LIBPNG has a heap buffer overflow in png_set_quantize"
    }
  ]
}

CVE-2026-0865 (GCVE-0-2026-0865)

Vulnerability from cvelistv5 – Published: 2026-01-20 21:26 – Updated: 2026-03-03 14:43

Title

wsgiref.headers.Headers allows header newline injection

Summary

User-controlled header names and values containing newlines can allow injecting HTTP headers.

Severity ?

5.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

PSF

References

URL

Tags

	https://github.com/python/cpython/pull/143917	patch
	https://github.com/python/cpython/issues/143916	issue-tracking
	https://mail.python.org/archives/list/security-an…	vendor-advisory
	https://github.com/python/cpython/commit/22e4d552…	patch
	https://github.com/python/cpython/commit/23e3c0ae…	patch
	https://github.com/python/cpython/commit/4802b96a…	patch
	https://github.com/python/cpython/commit/f7fceed7…	patch
	https://github.com/python/cpython/commit/2f840249…	patch
	https://github.com/python/cpython/commit/e4846a93…	patch
	https://github.com/python/cpython/commit/66da7bf6…	patch
	https://github.com/python/cpython/commit/83ecd187…	patch
	https://github.com/python/cpython/commit/bfba6600…	patch
	https://github.com/python/cpython/commit/286e3ac3…	patch
	https://github.com/python/cpython/commit/8bb044d2…	patch
	https://github.com/python/cpython/commit/c592227f…	patch

Impacted products

	Vendor	Product	Version
	Python Software Foundation	CPython	Affected: 0 , < 3.10.20 (python) Affected: 3.11.0 , < 3.11.15 (python) Affected: 3.12.0 , < 3.12.13 (python) Affected: 3.13.0 , < 3.13.12 (python) Affected: 3.14.0 , < 3.14.3 (python) Affected: 3.15.0a1 , < 3.15.0a6 (python)

Credits

Omar M. Hasan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0865",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-21T15:40:22.223517Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-21T16:14:52.038Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.10.20",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.15",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.13",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.12",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.3",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0a6",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Omar M. Hasan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "User-controlled header names and values containing newlines can allow injecting HTTP headers."
            }
          ],
          "value": "User-controlled header names and values containing newlines can allow injecting HTTP headers."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T14:43:30.596Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/143917"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/143916"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/22e4d55285cee52bc4dbe061324e5f30bd4dee58"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/23e3c0ae867cca0130e441e776c9955b9027c510"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/4802b96a2cde58570c24c13ef3289490980961c5"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/f7fceed79ca1bceae8dbe5ba5bc8928564da7211"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/2f840249550e082dc351743f474ba56da10478d2"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/e4846a93ac07a8ae9aa18203af0dd13d6e7a6995"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/66da7bf6fe7b81e3ecc9c0a25bd47d4616c8d1a6"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/83ecd18779f286d872f68bfce175651e407d9fff"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/bfba660085767f8c2d582134e9d511a85eda04cf"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/286e3ac39984fe85a17f4ab39c64d382137aae5f"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/8bb044d29310bb05d15086cdaa8bf64867d61a97"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/c592227ffb48679af9845a45dbb0875d975bb219"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "wsgiref.headers.Headers allows header newline injection",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-0865",
    "datePublished": "2026-01-20T21:26:15.274Z",
    "dateReserved": "2026-01-12T16:07:56.781Z",
    "dateUpdated": "2026-03-03T14:43:30.596Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23490 (GCVE-0-2026-23490)

Vulnerability from cvelistv5 – Published: 2026-01-16 19:03 – Updated: 2026-02-01 17:06

Title

pyasn1 has a DoS vulnerability in decoder

Summary

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

URL

Tags

	https://github.com/pyasn1/pyasn1/security/advisor…	x_refsource_CONFIRM
	https://github.com/pyasn1/pyasn1/commit/3908f1442…	x_refsource_MISC
	https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	pyasn1	pyasn1	Affected: < 0.6.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23490",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-16T19:23:28.531270Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-16T19:23:51.965Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-02-01T17:06:14.113Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyasn1",
          "vendor": "pyasn1",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.6.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-16T19:03:36.442Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq"
        },
        {
          "name": "https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970"
        },
        {
          "name": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2"
        }
      ],
      "source": {
        "advisory": "GHSA-63vm-454h-vhhq",
        "discovery": "UNKNOWN"
      },
      "title": "pyasn1 has a DoS vulnerability in decoder"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23490",
    "datePublished": "2026-01-16T19:03:36.442Z",
    "dateReserved": "2026-01-13T15:47:41.628Z",
    "dateUpdated": "2026-02-01T17:06:14.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-15367 (GCVE-0-2025-15367)

Vulnerability from cvelistv5 – Published: 2026-01-20 21:47 – Updated: 2026-02-26 14:44

Title

POP3 command injection in user-controlled commands

Summary

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Severity ?

5.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

PSF

References

URL

Tags

	https://github.com/python/cpython/pull/143924	patch
	https://github.com/python/cpython/issues/143923	issue-tracking
	https://mail.python.org/archives/list/security-an…	vendor-advisory
	https://github.com/python/cpython/commit/b234a2b6…	patch

Impacted products

	Vendor	Product	Version
	Python Software Foundation	CPython	Affected: 0 , < 3.15.0a6 (python)

Credits

Omar M. Hasan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-15367",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-22T04:55:33.480214Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T14:44:41.341Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "poplib"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.15.0a6",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Omar M. Hasan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."
            }
          ],
          "value": "The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-11T16:12:35.845Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/143924"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/143923"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "POP3 command injection in user-controlled commands",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2025-15367",
    "datePublished": "2026-01-20T21:47:09.885Z",
    "dateReserved": "2025-12-30T16:06:42.288Z",
    "dateUpdated": "2026-02-26T14:44:41.341Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22695 (GCVE-0-2026-22695)

Vulnerability from cvelistv5 – Published: 2026-01-12 22:55 – Updated: 2026-01-13 19:07

Title

LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix)

Summary

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.

Severity ?

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M

References

URL

Tags

	https://github.com/pnggroup/libpng/security/advis…	x_refsource_CONFIRM
	https://github.com/pnggroup/libpng/issues/778	x_refsource_MISC
	https://github.com/pnggroup/libpng/commit/218612d…	x_refsource_MISC
	https://github.com/pnggroup/libpng/commit/e4f7ad4ea2	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	pnggroup	libpng	Affected: < 1.6.54

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22695",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-13T14:13:00.487878Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-13T19:07:10.972Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libpng",
          "vendor": "pnggroup",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.54"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-12T22:55:40.204Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp"
        },
        {
          "name": "https://github.com/pnggroup/libpng/issues/778",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pnggroup/libpng/issues/778"
        },
        {
          "name": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea"
        },
        {
          "name": "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2"
        }
      ],
      "source": {
        "advisory": "GHSA-mmq5-27w3-rxpp",
        "discovery": "UNKNOWN"
      },
      "title": "LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22695",
    "datePublished": "2026-01-12T22:55:40.204Z",
    "dateReserved": "2026-01-08T19:23:09.855Z",
    "dateUpdated": "2026-01-13T19:07:10.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-25646 (GCVE-0-2026-25646)

Vulnerability from cvelistv5 – Published: 2026-02-10 17:04 – Updated: 2026-02-11 15:31

Title

LIBPNG has a heap buffer overflow in png_set_quantize

Summary

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.

Severity ?

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

CWE

CWE-122 - Heap-based Buffer Overflow
CWE-126 - Buffer Over-read

Assigner

GitHub_M

References

URL

Tags

	https://github.com/pnggroup/libpng/security/advis…	x_refsource_CONFIRM
	https://github.com/pnggroup/libpng/commit/01d03b8…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	pnggroup	libpng	Affected: < 1.6.55

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-02-10T17:25:31.583Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/02/09/7"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25646",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-11T15:31:50.552532Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-11T15:31:58.665Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libpng",
          "vendor": "pnggroup",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.55"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user\u0027s display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-126",
              "description": "CWE-126: Buffer Over-read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-10T17:04:38.501Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3"
        },
        {
          "name": "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88"
        }
      ],
      "source": {
        "advisory": "GHSA-g8hp-mq4h-rqm3",
        "discovery": "UNKNOWN"
      },
      "title": "LIBPNG has a heap buffer overflow in png_set_quantize"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25646",
    "datePublished": "2026-02-10T17:04:38.501Z",
    "dateReserved": "2026-02-04T05:15:41.791Z",
    "dateUpdated": "2026-02-11T15:31:58.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0861 (GCVE-0-2026-0861)

Vulnerability from cvelistv5 – Published: 2026-01-14 21:01 – Updated: 2026-01-16 17:06

Title

Integer overflow in memalign leads to heap corruption

Summary

Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc. Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.

Severity ?

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

glibc

References

URL

Tags

	https://sourceware.org/bugzilla/show_bug.cgi?id=33796
	https://sourceware.org/git/?p=glibc.git;a=blob_pl…

Impacted products

	Vendor	Product	Version
	The GNU C Library	glibc	Affected: 2.30 , ≤ 2.42 (custom)

Date Public ?

2026-01-14 05:00

Credits

Igor Morgenstern, Aisle Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-0861",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T21:24:01.342438Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T21:25:55.741Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-16T17:06:42.010Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/16/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "glibc",
          "vendor": "The GNU C Library",
          "versions": [
            {
              "lessThanOrEqual": "2.42",
              "status": "affected",
              "version": "2.30",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Igor Morgenstern, Aisle Research"
        }
      ],
      "datePublic": "2026-01-14T05:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.\u003cbr\u003e\u003cbr\u003eNote that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this.  The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument.  This limits the malicious inputs for the alignment for memalign to the range [1\u0026lt;\u0026lt;62+ 1, 1\u0026lt;\u0026lt;63] and exactly 1\u0026lt;\u0026lt;63 for posix_memalign and aligned_alloc.\u003cbr\u003e\u003cbr\u003eTypically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice.  An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments."
            }
          ],
          "value": "Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.\n\nNote that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this.  The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument.  This limits the malicious inputs for the alignment for memalign to the range [1\u003c\u003c62+ 1, 1\u003c\u003c63] and exactly 1\u003c\u003c63 for posix_memalign and aligned_alloc.\n\nTypically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice.  An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-129",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-129 Pointer Manipulation"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-16T14:37:33.544Z",
        "orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
        "shortName": "glibc"
      },
      "references": [
        {
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33796"
        },
        {
          "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Integer overflow in memalign leads to heap corruption",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
    "assignerShortName": "glibc",
    "cveId": "CVE-2026-0861",
    "datePublished": "2026-01-14T21:01:11.037Z",
    "dateReserved": "2026-01-12T14:35:11.285Z",
    "dateUpdated": "2026-01-16T17:06:42.010Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-15366 (GCVE-0-2025-15366)

Vulnerability from cvelistv5 – Published: 2026-01-20 21:40 – Updated: 2026-02-26 14:44

Title

IMAP command injection in user-controlled commands

Summary

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Severity ?

5.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

PSF

References

URL

Tags

	https://github.com/python/cpython/issues/143921	issue-tracking
	https://github.com/python/cpython/pull/143922	patch
	https://mail.python.org/archives/list/security-an…	vendor-advisory
	https://github.com/python/cpython/commit/6262704b…	patch

Impacted products

	Vendor	Product	Version
	Python Software Foundation	CPython	Affected: 0 , < 3.15.0a6 (python)

Credits

Omar M. Hasan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-15366",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-22T04:55:32.252111Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T14:44:41.682Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "imaplib"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.15.0a6",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Omar M. Hasan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."
            }
          ],
          "value": "The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-11T16:12:34.324Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/143921"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/143922"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IMAP command injection in user-controlled commands",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2025-15366",
    "datePublished": "2026-01-20T21:40:24.938Z",
    "dateReserved": "2025-12-30T16:06:41.731Z",
    "dateUpdated": "2026-02-26T14:44:41.682Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-1299 (GCVE-0-2026-1299)

Vulnerability from cvelistv5 – Published: 2026-01-23 16:27 – Updated: 2026-03-03 14:43

Title

email BytesGenerator header injection due to unquoted newlines

Summary

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".

Severity ?

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-93

Assigner

PSF

References

URL

Tags

	https://github.com/python/cpython/pull/144126	patch
	https://github.com/python/cpython/issues/144125	issue-tracking
	https://cve.org/CVERecord?id=CVE-2024-6923	related
	https://mail.python.org/archives/list/security-an…	vendor-advisory
	https://github.com/python/cpython/commit/052e55e7…	patch
	https://github.com/python/cpython/commit/0a925ab5…	patch
	https://github.com/python/cpython/commit/7877fe42…	patch
	https://github.com/python/cpython/commit/842ce19a…	patch
	https://github.com/python/cpython/commit/8cdf6204…	patch
	https://github.com/python/cpython/commit/e417f05a…	patch

Impacted products

	Vendor	Product	Version
	Python Software Foundation	CPython	Affected: 0 , < 3.10.20 (python) Affected: 3.11.0 , < 3.11.15 (python) Affected: 3.12.0 , < 3.12.13 (python) Affected: 3.13.0 , < 3.13.12 (python) Affected: 3.14.0 , < 3.14.3 (python) Affected: 3.15.0a1 , < 3.15.0a6 (python)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1299",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-23T16:55:59.722632Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-23T16:56:22.155Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "email"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.10.20",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.15",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.13",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.12",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.3",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0a6",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The \nemail module, specifically the \"BytesGenerator\" class, didn\u2019t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized. This is only applicable if using \"LiteralHeader\" writing headers that don\u0027t respect email folding rules, the new behavior will reject the incorrectly folded headers in \"BytesGenerator\"."
            }
          ],
          "value": "The \nemail module, specifically the \"BytesGenerator\" class, didn\u2019t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized. This is only applicable if using \"LiteralHeader\" writing headers that don\u0027t respect email folding rules, the new behavior will reject the incorrectly folded headers in \"BytesGenerator\"."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-93",
              "description": "CWE-93",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T14:43:35.655Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/144126"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/144125"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cve.org/CVERecord?id=CVE-2024-6923"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/0a925ab591c45d6638f37b5e57796f36fa0e56d8"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/7877fe424415bc4a13045e62a90a7277413d8cb9"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/842ce19a0c0b58d61591e8f6a708c38db1fb94e4"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/8cdf6204f4ae821f32993f8fc6bad0d318f95f36"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/e417f05ad77a4c30ddc07f99e90fc0cef43e831a"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "email BytesGenerator header injection due to unquoted newlines",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-1299",
    "datePublished": "2026-01-23T16:27:13.346Z",
    "dateReserved": "2026-01-21T18:30:52.594Z",
    "dateUpdated": "2026-03-03T14:43:35.655Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22801 (GCVE-0-2026-22801)

Vulnerability from cvelistv5 – Published: 2026-01-12 22:57 – Updated: 2026-01-13 19:37

Title

LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_*

Summary

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.

Severity ?

6.8 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

CWE

CWE-125 - Out-of-bounds Read
CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M

References

URL

Tags

https://github.com/pnggroup/libpng/security/advis…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	pnggroup	libpng	Affected: < 1.6.54

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22801",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-13T19:37:38.282435Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-13T19:37:45.414Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libpng",
          "vendor": "pnggroup",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.54"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-12T22:57:58.288Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8"
        }
      ],
      "source": {
        "advisory": "GHSA-vgjq-8cw5-ggw8",
        "discovery": "UNKNOWN"
      },
      "title": "LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_*"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22801",
    "datePublished": "2026-01-12T22:57:58.288Z",
    "dateReserved": "2026-01-09T22:50:10.287Z",
    "dateUpdated": "2026-01-13T19:37:45.414Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14831 (GCVE-0-2025-14831)

Vulnerability from cvelistv5 – Published: 2026-02-09 14:51 – Updated: 2026-03-24 10:39

Title

Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification

Summary

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

redhat

References

URL

Tags

	https://access.redhat.com/errata/RHSA-2026:3477	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:4188	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:4655	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:4943	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:5585	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:5606	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2025-14831	vdb-entryx_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2423177	issue-trackingx_refsource_REDHAT
	https://gitlab.com/gnutls/gnutls/-/issues/1773

Impacted products

Vendor

Product

Version

Red Hat

Red Hat Enterprise Linux 10

Unaffected: 0:3.8.10-3.el10_1 , < * (rpm)
cpe:/o:redhat:enterprise_linux:10.1

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.6.16-8.el8_10.5 , < * (rpm) cpe:/o:redhat:enterprise_linux:8::baseos cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.6.16-8.el8_10.5 , < * (rpm) cpe:/o:redhat:enterprise_linux:8::baseos cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.8.3-10.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.8.3-10.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Ceph Storage 8	Unaffected: sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1 , < * (rpm) cpe:/a:redhat:ceph_storage:8::el9
Red Hat	Red Hat Insights proxy 1.5	Unaffected: sha256:86431fdb1ba7fa0cbc8e82cc5fe518b7c0946b8847991fc95604b1d1cfd45e06 , < * (rpm) cpe:/a:redhat:insights_proxy:1.5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: sha256:200c27e9b396276bd505c6b41127ac5eb1d94d620172cb818ae733f2a21ac524 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: sha256:d98fd3fe5f5f9acd0efae7db19b61b864be1eb2fbe2586a1b6be2429fa2cc7a3 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: sha256:2c50c87906a1abebf427a70f401c409f1258cb55d2096f517db870ec991cfd7f , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: sha256:5f1fbf66fb349a7baf066a1216d39989c3b89f18ec5108b96d9643baf4856778 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public ?

2026-02-09 14:26

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14831",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-09T15:25:49.680881Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-09T15:26:01.239Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.1"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.8.10-3.el10_1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8::baseos",
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.16-8.el8_10.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8::baseos",
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.16-8.el8_10.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.8.3-10.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.8.3-10.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ceph_storage:8::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhceph/rhceph-8-rhel9",
          "product": "Red Hat Ceph Storage 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:insights_proxy:1.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "insights-proxy/insights-proxy-container-rhel9",
          "product": "Red Hat Insights proxy 1.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:86431fdb1ba7fa0cbc8e82cc5fe518b7c0946b8847991fc95604b1d1cfd45e06",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/cds-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:200c27e9b396276bd505c6b41127ac5eb1d94d620172cb818ae733f2a21ac524",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/haproxy-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:d98fd3fe5f5f9acd0efae7db19b61b864be1eb2fbe2586a1b6be2429fa2cc7a3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/installer-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:2c50c87906a1abebf427a70f401c409f1258cb55d2096f517db870ec991cfd7f",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/rhua-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:5f1fbf66fb349a7baf066a1216d39989c3b89f18ec5108b96d9643baf4856778",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-02-09T14:26:34.939Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-24T10:39:57.915Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:3477",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:3477"
        },
        {
          "name": "RHSA-2026:4188",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:4188"
        },
        {
          "name": "RHSA-2026:4655",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:4655"
        },
        {
          "name": "RHSA-2026:4943",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:4943"
        },
        {
          "name": "RHSA-2026:5585",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:5585"
        },
        {
          "name": "RHSA-2026:5606",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-14831"
        },
        {
          "name": "RHBZ#2423177",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423177"
        },
        {
          "url": "https://gitlab.com/gnutls/gnutls/-/issues/1773"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-12-17T14:48:30.222Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-02-09T14:26:34.939Z",
          "value": "Made public."
        }
      ],
      "title": "Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-407: Inefficient Algorithmic Complexity"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-14831",
    "datePublished": "2026-02-09T14:51:32.447Z",
    "dateReserved": "2025-12-17T14:44:59.859Z",
    "dateUpdated": "2026-03-24T10:39:57.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-12801 (GCVE-0-2025-12801)

Vulnerability from cvelistv5 – Published: 2026-03-04 15:25 – Updated: 2026-03-25 04:59

Title

Nfs-utils: rpc.mountd in the nfs-utils privilege escalation

Summary

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-279 - Incorrect Execution-Assigned Permissions

Assigner

redhat

References

URL

Tags

	https://access.redhat.com/errata/RHSA-2026:3938	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:3939	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:3940	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:3941	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:3942	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:5127	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:5606	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2025-12801	vdb-entryx_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2413081	issue-trackingx_refsource_REDHAT

Impacted products

Vendor

Product

Version

Red Hat

Red Hat Enterprise Linux 10

Unaffected: 1:2.8.3-0.el10_1.3 , < * (rpm)
cpe:/o:redhat:enterprise_linux:10.1

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 1:2.3.3-68.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8::baseos cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 1:2.5.4-38.el9_7.3 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 1:2.5.4-38.el9_7.3 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 1:2.5.4-26.el9_4.3 , < * (rpm) cpe:/o:redhat:rhel_eus:9.4::baseos cpe:/a:redhat:rhel_eus:9.4::appstream cpe:/a:redhat:rhel_eus:9.4::crb
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 1:2.5.4-34.el9_6.3 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6::crb cpe:/o:redhat:rhel_eus:9.6::baseos cpe:/a:redhat:rhel_eus:9.6::appstream
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 418.94.202603181125-0 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat Ceph Storage 8	Unaffected: sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1 , < * (rpm) cpe:/a:redhat:ceph_storage:8::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Date Public ?

2026-03-04 15:06

Credits

Red Hat would like to thank Simon Hall for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12801",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-04T16:16:10.569638Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-04T16:16:16.509Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.1"
          ],
          "defaultStatus": "affected",
          "packageName": "nfs-utils",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:2.8.3-0.el10_1.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8::baseos",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "nfs-utils",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:2.3.3-68.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "nfs-utils",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:2.5.4-38.el9_7.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "nfs-utils",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:2.5.4-38.el9_7.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_eus:9.4::baseos",
            "cpe:/a:redhat:rhel_eus:9.4::appstream",
            "cpe:/a:redhat:rhel_eus:9.4::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "nfs-utils",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:2.5.4-26.el9_4.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::crb",
            "cpe:/o:redhat:rhel_eus:9.6::baseos",
            "cpe:/a:redhat:rhel_eus:9.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "nfs-utils",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:2.5.4-34.el9_6.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "418.94.202603181125-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ceph_storage:8::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhceph/rhceph-8-rhel9",
          "product": "Red Hat Ceph Storage 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "nfs-utils",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "nfs-utils-lib",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "nfs-utils",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Simon Hall for reporting this issue."
        }
      ],
      "datePublic": "2026-03-04T15:06:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the\nprivileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any \u0027root_squash\u0027 or \u0027all_squash\u0027 attributes that would normally be expected to apply to that client."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-279",
              "description": "Incorrect Execution-Assigned Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-25T04:59:21.718Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:3938",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:3938"
        },
        {
          "name": "RHSA-2026:3939",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:3939"
        },
        {
          "name": "RHSA-2026:3940",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:3940"
        },
        {
          "name": "RHSA-2026:3941",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:3941"
        },
        {
          "name": "RHSA-2026:3942",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:3942"
        },
        {
          "name": "RHSA-2026:5127",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:5127"
        },
        {
          "name": "RHSA-2026:5606",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-12801"
        },
        {
          "name": "RHBZ#2413081",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413081"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-11-06T12:15:57.744Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-03-04T15:06:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Nfs-utils: rpc.mountd in the nfs-utils privilege escalation",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-279: Incorrect Execution-Assigned Permissions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-12801",
    "datePublished": "2026-03-04T15:25:53.403Z",
    "dateReserved": "2025-11-06T12:17:26.749Z",
    "dateUpdated": "2026-03-25T04:59:21.718Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-15281 (GCVE-0-2025-15281)

Vulnerability from cvelistv5 – Published: 2026-01-20 13:22 – Updated: 2026-01-22 19:21

Title

wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory

Summary

Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-908 - Use of Uninitialized Resource

Assigner

glibc

References

URL

Tags

https://sourceware.org/bugzilla/show_bug.cgi?id=33814

Impacted products

	Vendor	Product	Version
	The GNU C Library	glibc	Affected: 2.0 , ≤ 2.42 (custom)

Credits

Vitaly Simonovich

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-20T17:08:42.853Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/20/3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-15281",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-22T19:21:34.491759Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-22T19:21:38.455Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "glibc",
          "vendor": "The GNU C Library",
          "versions": [
            {
              "lessThanOrEqual": "2.42",
              "status": "affected",
              "version": "2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Vitaly Simonovich"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eCalling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.\u003c/div\u003e"
            }
          ],
          "value": "Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-129",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-129 Pointer Manipulation"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-908",
              "description": "CWE-908 Use of Uninitialized Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-20T13:22:46.495Z",
        "orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
        "shortName": "glibc"
      },
      "references": [
        {
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33814"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
    "assignerShortName": "glibc",
    "cveId": "CVE-2025-15281",
    "datePublished": "2026-01-20T13:22:46.495Z",
    "dateReserved": "2025-12-29T20:07:29.736Z",
    "dateUpdated": "2026-01-22T19:21:38.455Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0915 (GCVE-0-2026-0915)

Vulnerability from cvelistv5 – Published: 2026-01-15 22:08 – Updated: 2026-01-20 16:03

Title

getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler

Summary

Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-908 - Use of Uninitialized Resource

Assigner

glibc

References

URL

Tags

https://sourceware.org/bugzilla/show_bug.cgi?id=33802

Impacted products

	Vendor	Product	Version
	The GNU C Library	glibc	Affected: 2.0 , ≤ 2.42 (custom)

Credits

Igor Morgenstern, Aisle Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-16T17:06:43.013Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/16/6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-0915",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-20T16:03:19.464174Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-20T16:03:52.590Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33802"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "glibc",
          "vendor": "The GNU C Library",
          "versions": [
            {
              "lessThanOrEqual": "2.42",
              "status": "affected",
              "version": "2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Igor Morgenstern, Aisle Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library\u0027s DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver."
            }
          ],
          "value": "Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library\u0027s DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-204",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-204 Lifting Sensitive Data Embedded in Cache"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-908",
              "description": "CWE-908 Use of Uninitialized Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T22:08:41.630Z",
        "orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
        "shortName": "glibc"
      },
      "references": [
        {
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33802"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
    "assignerShortName": "glibc",
    "cveId": "CVE-2026-0915",
    "datePublished": "2026-01-15T22:08:41.630Z",
    "dateReserved": "2026-01-13T19:02:42.388Z",
    "dateUpdated": "2026-01-20T16:03:52.590Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-9820 (GCVE-0-2025-9820)

Vulnerability from cvelistv5 – Published: 2026-01-26 19:58 – Updated: 2026-03-24 10:39

Title

Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

Summary

Severity ?

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

redhat

References

URL

Tags

	https://access.redhat.com/errata/RHSA-2026:3477	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:4188	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:4655	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:4943	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:5585	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:5606	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2025-9820	vdb-entryx_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2392528	issue-trackingx_refsource_REDHAT
	https://gitlab.com/gnutls/gnutls/-/commit/1d56f96…
	https://gitlab.com/gnutls/gnutls/-/issues/1732
	https://www.gnutls.org/security-new.html#GNUTLS-S…

Impacted products

Vendor

Product

Version

Red Hat

Red Hat Enterprise Linux 10

Unaffected: 0:3.8.10-3.el10_1 , < * (rpm)
cpe:/o:redhat:enterprise_linux:10.1

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.6.16-8.el8_10.5 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.6.16-8.el8_10.5 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.8.3-10.el9_7 , < * (rpm) cpe:/o:redhat:enterprise_linux:9::baseos cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.8.3-10.el9_7 , < * (rpm) cpe:/o:redhat:enterprise_linux:9::baseos cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Ceph Storage 8	Unaffected: sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1 , < * (rpm) cpe:/a:redhat:ceph_storage:8::el9
Red Hat	Red Hat Insights proxy 1.5	Unaffected: sha256:86431fdb1ba7fa0cbc8e82cc5fe518b7c0946b8847991fc95604b1d1cfd45e06 , < * (rpm) cpe:/a:redhat:insights_proxy:1.5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: sha256:200c27e9b396276bd505c6b41127ac5eb1d94d620172cb818ae733f2a21ac524 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: sha256:d98fd3fe5f5f9acd0efae7db19b61b864be1eb2fbe2586a1b6be2429fa2cc7a3 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: sha256:2c50c87906a1abebf427a70f401c409f1258cb55d2096f517db870ec991cfd7f , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: sha256:5f1fbf66fb349a7baf066a1216d39989c3b89f18ec5108b96d9643baf4856778 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public ?

2025-11-18 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-26T20:08:12.926Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/11/20/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9820",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-26T20:10:45.615719Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-26T20:12:19.249Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.1"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.8.10-3.el10_1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.16-8.el8_10.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.16-8.el8_10.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9::baseos",
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.8.3-10.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9::baseos",
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.8.3-10.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ceph_storage:8::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhceph/rhceph-8-rhel9",
          "product": "Red Hat Ceph Storage 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:insights_proxy:1.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "insights-proxy/insights-proxy-container-rhel9",
          "product": "Red Hat Insights proxy 1.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:86431fdb1ba7fa0cbc8e82cc5fe518b7c0946b8847991fc95604b1d1cfd45e06",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/cds-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:200c27e9b396276bd505c6b41127ac5eb1d94d620172cb818ae733f2a21ac524",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/haproxy-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:d98fd3fe5f5f9acd0efae7db19b61b864be1eb2fbe2586a1b6be2429fa2cc7a3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/installer-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:2c50c87906a1abebf427a70f401c409f1258cb55d2096f517db870ec991cfd7f",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/rhua-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:5f1fbf66fb349a7baf066a1216d39989c3b89f18ec5108b96d9643baf4856778",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "gnutls",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-11-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-24T10:39:53.293Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:3477",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:3477"
        },
        {
          "name": "RHSA-2026:4188",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:4188"
        },
        {
          "name": "RHSA-2026:4655",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:4655"
        },
        {
          "name": "RHSA-2026:4943",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:4943"
        },
        {
          "name": "RHSA-2026:5585",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:5585"
        },
        {
          "name": "RHSA-2026:5606",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:5606"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-9820"
        },
        {
          "name": "RHBZ#2392528",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392528"
        },
        {
          "url": "https://gitlab.com/gnutls/gnutls/-/commit/1d56f96f6ab5034d677136b9d50b5a75dff0faf5"
        },
        {
          "url": "https://gitlab.com/gnutls/gnutls/-/issues/1732"
        },
        {
          "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-09-02T10:00:18.839Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-11-18T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Applying the upstream patch or vendor-supplied security update is the recommended resolution."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-121: Stack-based Buffer Overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-9820",
    "datePublished": "2026-01-26T19:58:32.886Z",
    "dateReserved": "2025-09-02T07:22:32.478Z",
    "dateUpdated": "2026-03-24T10:39:53.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2026:5606

CVE-2026-0865 (GCVE-0-2026-0865)

CVE-2026-23490 (GCVE-0-2026-23490)

CVE-2025-15367 (GCVE-0-2025-15367)

CVE-2026-22695 (GCVE-0-2026-22695)

CVE-2026-25646 (GCVE-0-2026-25646)

CVE-2026-0861 (GCVE-0-2026-0861)

CVE-2025-15366 (GCVE-0-2025-15366)

CVE-2026-1299 (GCVE-0-2026-1299)

CVE-2026-22801 (GCVE-0-2026-22801)

CVE-2025-14831 (GCVE-0-2025-14831)

CVE-2025-12801 (GCVE-0-2025-12801)

CVE-2025-15281 (GCVE-0-2025-15281)

CVE-2026-0915 (GCVE-0-2026-0915)

CVE-2025-9820 (GCVE-0-2025-9820)

Tags

Sightings

Nomenclature