{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\napr-util:\n  * apr-util-1.6.5-1.hum1 (aarch64, x86_64)\n  * apr-util-devel-1.6.5-1.hum1 (aarch64, x86_64)\n  * apr-util-ldap-1.6.5-1.hum1 (aarch64, x86_64)\n  * apr-util-lmdb-1.6.5-1.hum1 (aarch64, x86_64)\n  * apr-util-mysql-1.6.5-1.hum1 (aarch64, x86_64)\n  * apr-util-odbc-1.6.5-1.hum1 (aarch64, x86_64)\n  * apr-util-openssl-1.6.5-1.hum1 (aarch64, x86_64)\n  * apr-util-pgsql-1.6.5-1.hum1 (aarch64, x86_64)\n  * apr-util-sqlite-1.6.5-1.hum1 (aarch64, x86_64)\n  * apr-util-1.6.5-1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:58474",
        "url": "https://access.redhat.com/errata/RHSA-2026:58474"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-49506",
        "url": "https://access.redhat.com/security/cve/CVE-2025-49506"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34501",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34501"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34502",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34502"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32327",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32327"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58474.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-08-24T14:49:25+00:00",
      "generator": {
        "date": "2026-08-24T14:49:25+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:58474",
      "initial_release_date": "2026-08-22T00:58:40+00:00",
      "revision_history": [
        {
          "date": "2026-08-22T00:58:40+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T06:15:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-24T14:49:25+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apr-util-main@aarch64",
                "product": {
                  "name": "apr-util-main@aarch64",
                  "product_id": "apr-util-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apr-util@1.6.5-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apr-util-main@src",
                "product": {
                  "name": "apr-util-main@src",
                  "product_id": "apr-util-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apr-util@1.6.5-1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apr-util-main@x86_64",
                "product": {
                  "name": "apr-util-main@x86_64",
                  "product_id": "apr-util-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apr-util@1.6.5-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apr-util-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:apr-util-main@aarch64"
        },
        "product_reference": "apr-util-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apr-util-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:apr-util-main@src"
        },
        "product_reference": "apr-util-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apr-util-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:apr-util-main@x86_64"
        },
        "product_reference": "apr-util-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-49506",
      "cwe": {
        "id": "CWE-208",
        "name": "Observable Timing Discrepancy"
      },
      "discovery_date": "2026-08-06T14:41:23.697309+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2512077"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Portable Runtime Utility (apr-util). The `apr_password_validate()` function does not perform constant-time comparisons for hashes or passwords. This vulnerability allows a remote attacker to conduct a timing attack, particularly on platforms without `crypt()` such as Windows, BeOS, NetWare, or Android. By observing the time differences in comparisons, an attacker could potentially deduce the content of sensitive information like password hashes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is assessed as Low Impact due to significant practical exploitation barriers. While the theoretical outcome of a successful timing attack is hash disclosure (Confidentiality: High), isolating microsecond-level comparison differences over a network is rendered practically infeasible by unpredictable network latency, packet jitter, and server scheduling noise (Attack Complexity: High). Additionally, RHEL environments natively rely on the system crypt() implementation for standard password checks, bypassing the vulnerable non-constant-time fallback code path in standard deployment scenarios.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:apr-util-main@aarch64",
          "Red Hat Hardened Images:apr-util-main@src",
          "Red Hat Hardened Images:apr-util-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-49506"
        },
        {
          "category": "external",
          "summary": "RHBZ#2512077",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512077"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49506",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-49506"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49506",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49506"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5",
          "url": "https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5"
        }
      ],
      "release_date": "2026-08-06T14:33:12.957000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-22T00:58:40+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:apr-util-main@aarch64",
            "Red Hat Hardened Images:apr-util-main@src",
            "Red Hat Hardened Images:apr-util-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58474"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:apr-util-main@aarch64",
            "Red Hat Hardened Images:apr-util-main@src",
            "Red Hat Hardened Images:apr-util-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:apr-util-main@aarch64",
            "Red Hat Hardened Images:apr-util-main@src",
            "Red Hat Hardened Images:apr-util-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation"
    },
    {
      "cve": "CVE-2026-32327",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-06T14:41:30.265375+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2512079"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Portable Runtime Utility (apr-util). A remote attacker could exploit a stack recursion vulnerability by providing specially crafted XML input to a library consumer that uses the `apr_xml_quote_elem()` function. This could lead to a denial of service (DoS) due to an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:apr-util-main@aarch64",
          "Red Hat Hardened Images:apr-util-main@src",
          "Red Hat Hardened Images:apr-util-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32327"
        },
        {
          "category": "external",
          "summary": "RHBZ#2512079",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512079"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32327",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32327"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32327",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32327"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1",
          "url": "https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1"
        }
      ],
      "release_date": "2026-08-06T14:32:43.526000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-22T00:58:40+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:apr-util-main@aarch64",
            "Red Hat Hardened Images:apr-util-main@src",
            "Red Hat Hardened Images:apr-util-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58474"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:apr-util-main@aarch64",
            "Red Hat Hardened Images:apr-util-main@src",
            "Red Hat Hardened Images:apr-util-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:apr-util-main@aarch64",
            "Red Hat Hardened Images:apr-util-main@src",
            "Red Hat Hardened Images:apr-util-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack"
    },
    {
      "cve": "CVE-2026-34501",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-08-06T14:41:07.274036+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2512073"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Redis client in the Apache Portable Runtime Utility (apr-util). A heap buffer overflow can be triggered when the application processes a specially crafted response from a Redis server, resulting in a crash and denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The impact of this vulnerability is rated as Moderate. Although the flaw involves a heap buffer overflow and the CVSS base score reflects an unauthenticated network vector, exploitation requires the attacker to control or compromise the Redis server that the application queries. An attacker cannot trigger this condition by sending data directly to the affected application \u2014 they must first be in a position to influence Redis responses, either by compromising the Redis backend or performing a man-in-the-middle attack on the connection. Additionally, the overflow does not result in arbitrary code execution; the observed impact is limited to a denial of service. This prerequisite significantly limits real-world exploitability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:apr-util-main@aarch64",
          "Red Hat Hardened Images:apr-util-main@src",
          "Red Hat Hardened Images:apr-util-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34501"
        },
        {
          "category": "external",
          "summary": "RHBZ#2512073",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512073"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34501"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/o8h6c7cq86fplxlnry6c3rn9x0ovq8mv",
          "url": "https://lists.apache.org/thread/o8h6c7cq86fplxlnry6c3rn9x0ovq8mv"
        }
      ],
      "release_date": "2026-08-06T14:31:48.356000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-22T00:58:40+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:apr-util-main@aarch64",
            "Red Hat Hardened Images:apr-util-main@src",
            "Red Hat Hardened Images:apr-util-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58474"
        },
        {
          "category": "workaround",
          "details": "Ensure that the Redis server used by the application is deployed in a trusted, network-segregated environment and is not accessible to untrusted parties. Where possible, configure authentication and TLS on the Redis connection to reduce the risk of a compromised or spoofed Redis server.",
          "product_ids": [
            "Red Hat Hardened Images:apr-util-main@aarch64",
            "Red Hat Hardened Images:apr-util-main@src",
            "Red Hat Hardened Images:apr-util-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:apr-util-main@aarch64",
            "Red Hat Hardened Images:apr-util-main@src",
            "Red Hat Hardened Images:apr-util-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client"
    },
    {
      "cve": "CVE-2026-34502",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-08-06T14:41:42.884903+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2512083"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the memcached client in the Apache Portable Runtime Utility (apr-util). A remote, unauthenticated attacker can cause the application to crash or become unresponsive by sending a specially crafted response from a malicious or compromised memcached server, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The impact of this vulnerability is rated as Moderate. While the flaw is network-reachable and requires no authentication against the application itself, exploitation depends on the attacker controlling or compromising the memcached server that the application queries. An attacker cannot trigger the denial of service by sending data directly to the affected application \u2014 they must first be in a position to influence memcached responses, either by compromising the memcached backend or performing a man-in-the-middle attack on the connection between the application and memcached. This prerequisite significantly limits the real-world exploitability compared to a direct network denial-of-service attack.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:apr-util-main@aarch64",
          "Red Hat Hardened Images:apr-util-main@src",
          "Red Hat Hardened Images:apr-util-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34502"
        },
        {
          "category": "external",
          "summary": "RHBZ#2512083",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512083"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34502",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34502"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34502",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34502"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/spk5643m4vq0mb8h5b9hz9gkp57ombl8",
          "url": "https://lists.apache.org/thread/spk5643m4vq0mb8h5b9hz9gkp57ombl8"
        }
      ],
      "release_date": "2026-08-06T14:31:07.682000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-22T00:58:40+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:apr-util-main@aarch64",
            "Red Hat Hardened Images:apr-util-main@src",
            "Red Hat Hardened Images:apr-util-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58474"
        },
        {
          "category": "workaround",
          "details": "Restrict network access for applications that use the `apr-util` memcached client to communicate only with trusted memcached servers. Ensure that Red Hat products are configured to avoid connecting to untrusted or publicly exposed memcached instances. If the memcached client functionality is not essential, consider disabling or removing any dependent components. A service restart may be required for changes to take effect.",
          "product_ids": [
            "Red Hat Hardened Images:apr-util-main@aarch64",
            "Red Hat Hardened Images:apr-util-main@src",
            "Red Hat Hardened Images:apr-util-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:apr-util-main@aarch64",
            "Red Hat Hardened Images:apr-util-main@src",
            "Red Hat Hardened Images:apr-util-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client"
    }
  ]
}