{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Container Platform release 4.16.70 is now available with updates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.16.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container Platform 4.16.70. See the following advisory for the RPM packages for this release:\n\nhttps://access.redhat.com/errata/RHSA-2026:62548\n\nSpace precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nSecurity Fix(es):\n\n* unbound: Unbound Cache poisoning (CVE-2025-5994)\n* sqlite: Integer Truncation in SQLite (CVE-2025-6965)\n* podman: Podman kube play command may overwrite host files (CVE-2025-9566)\n* libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794)\n* libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796)\n* kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518)\n* bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)\n* samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)\n* bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)\n* bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)\n* dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)\n* bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)\n* bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)\n* dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816)\n* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)\n* kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)\n* openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap (CVE-2025-9230)\n* samba: vfs_worm does not block directory modification (CVE-2026-2340)\n* gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison (CVE-2026-3833)\n* bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)\n* systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:62549",
        "url": "https://access.redhat.com/errata/RHSA-2026:62549"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2372373",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372373"
      },
      {
        "category": "external",
        "summary": "2372385",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372385"
      },
      {
        "category": "external",
        "summary": "2380149",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380149"
      },
      {
        "category": "external",
        "summary": "2380949",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380949"
      },
      {
        "category": "external",
        "summary": "2393152",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2393152"
      },
      {
        "category": "external",
        "summary": "2396054",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396054"
      },
      {
        "category": "external",
        "summary": "2445763",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
      },
      {
        "category": "external",
        "summary": "2447318",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447318"
      },
      {
        "category": "external",
        "summary": "2447319",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447319"
      },
      {
        "category": "external",
        "summary": "2450505",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450505"
      },
      {
        "category": "external",
        "summary": "2451305",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451305"
      },
      {
        "category": "external",
        "summary": "2459963",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963"
      },
      {
        "category": "external",
        "summary": "2467015",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467015"
      },
      {
        "category": "external",
        "summary": "2477784",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477784"
      },
      {
        "category": "external",
        "summary": "2479767",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479767"
      },
      {
        "category": "external",
        "summary": "2479771",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479771"
      },
      {
        "category": "external",
        "summary": "2480756",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
      },
      {
        "category": "external",
        "summary": "2500889",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500889"
      },
      {
        "category": "external",
        "summary": "2503721",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503721"
      },
      {
        "category": "external",
        "summary": "2504166",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504166"
      },
      {
        "category": "external",
        "summary": "2504560",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504560"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62549.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Container Platform 4.16.70 bug fix and security update",
    "tracking": {
      "current_release_date": "2026-09-10T10:01:36+00:00",
      "generator": {
        "date": "2026-09-10T10:01:36+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.18"
        }
      },
      "id": "RHSA-2026:62549",
      "initial_release_date": "2026-09-10T09:01:14+00:00",
      "revision_history": [
        {
          "date": "2026-09-10T09:01:14+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-10T09:01:14+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-10T10:01:36+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4.16",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.16",
                  "product_id": "9Base-RHOSE-4.16",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:4.16::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-aarch64-416.94.202609011112-0",
                "product": {
                  "name": "rhcos-aarch64-416.94.202609011112-0",
                  "product_id": "rhcos-aarch64-416.94.202609011112-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@416.94.202609011112?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-ppc64le-416.94.202609011112-0",
                "product": {
                  "name": "rhcos-ppc64le-416.94.202609011112-0",
                  "product_id": "rhcos-ppc64le-416.94.202609011112-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@416.94.202609011112?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-s390x-416.94.202609011112-0",
                "product": {
                  "name": "rhcos-s390x-416.94.202609011112-0",
                  "product_id": "rhcos-s390x-416.94.202609011112-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@416.94.202609011112?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-x86_64-416.94.202609011112-0",
                "product": {
                  "name": "rhcos-x86_64-416.94.202609011112-0",
                  "product_id": "rhcos-x86_64-416.94.202609011112-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@416.94.202609011112?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-aarch64-416.94.202609011112-0 as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0"
        },
        "product_reference": "rhcos-aarch64-416.94.202609011112-0",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-ppc64le-416.94.202609011112-0 as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0"
        },
        "product_reference": "rhcos-ppc64le-416.94.202609011112-0",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-s390x-416.94.202609011112-0 as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0"
        },
        "product_reference": "rhcos-s390x-416.94.202609011112-0",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-x86_64-416.94.202609011112-0 as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        },
        "product_reference": "rhcos-x86_64-416.94.202609011112-0",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-5994",
      "cwe": {
        "id": "CWE-349",
        "name": "Acceptance of Extraneous Untrusted Data With Trusted Data"
      },
      "discovery_date": "2025-07-16T15:01:36.497027+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2380949"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A cache poisoning flaw was found in Unbound. Resolvers supporting EDNS Client Subnet (ECS) must segregate outgoing queries to accommodate different outgoing ECS information. This issue reopens resolvers to a birthday paradox attack, known as the Rebirthday Attack, which attempts to match the DNS transaction ID with cache non-ECS poisoned replies.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "unbound: Unbound Cache poisoning",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is considered Important rather than Moderate because it directly compromises the integrity of DNS caching mechanisms in resolvers supporting EDNS Client Subnet (ECS). The flaw allows an attacker to exploit the birthday paradox by generating a high volume of concurrent queries with different ECS values, thereby increasing the chance of a transaction ID collision with a spoofed response. If the resolver fails to properly segregate cache entries by ECS scope, it may accept and cache a malicious non-ECS response, effectively leading to DNS cache poisoning. Unlike typical poisoning attempts that require precise timing or privileged network positions, this attack can be carried out remotely with a high success rate, especially in resolvers that do not correctly isolate ECS queries.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-5994"
        },
        {
          "category": "external",
          "summary": "RHBZ#2380949",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380949"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-5994",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-5994"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-5994",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5994"
        },
        {
          "category": "external",
          "summary": "https://nlnetlabs.nl/downloads/unbound/CVE-2025-5994.txt",
          "url": "https://nlnetlabs.nl/downloads/unbound/CVE-2025-5994.txt"
        }
      ],
      "release_date": "2025-07-16T14:38:22.738000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "unbound: Unbound Cache poisoning"
    },
    {
      "cve": "CVE-2025-6965",
      "cwe": {
        "id": "CWE-197",
        "name": "Numeric Truncation Error"
      },
      "discovery_date": "2025-07-15T14:02:19.241458+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2380149"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory corruption flaw was found in SQLite. Under specific conditions a query can be generated where the number of aggregate terms could exceed the number of columns available. This issue could lead to memory corruption and subsequent unintended behavior.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sqlite: Integer Truncation in SQLite",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in SQLite is categorized as Important rather than Critical because, although it involves memory corruption, the conditions required to trigger it are relatively constrained. The flaw arises when a query causes the number of aggregate terms to exceed internal limits, leading to potential buffer overflows or memory mismanagement. However, exploitation requires the ability to craft complex SQL queries and interact with the SQLite engine in a specific manner\u2014typically through direct SQL input. There is no known evidence of arbitrary code execution, privilege escalation, or remote exploitability as a direct result of this flaw. Additionally, most SQLite deployments are embedded in applications where input is tightly controlled or sanitized.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-6965"
        },
        {
          "category": "external",
          "summary": "RHBZ#2380149",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380149"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-6965",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-6965"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-6965",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6965"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpujan2026.html#AppendixMSQL",
          "url": "https://www.oracle.com/security-alerts/cpujan2026.html#AppendixMSQL"
        },
        {
          "category": "external",
          "summary": "https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8",
          "url": "https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8"
        }
      ],
      "release_date": "2025-07-15T13:44:00.784000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sqlite: Integer Truncation in SQLite"
    },
    {
      "cve": "CVE-2025-9230",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2025-09-17T12:15:34.387000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2396054"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OpenSSL CMS implementation (RFC 3211 KEK Unwrap). This vulnerability allows memory corruption, an application level denial of service, or potential execution of attacker-supplied code via crafted CMS messages using password-based encryption (PWRI).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The vulnerability was rated as Moderate because, while the potential impact includes an application level denial of service and possible arbitrary code execution, successful exploitation is considered unlikely due to the high attack complexity and the fact that password-based CMS encryption (PWRI) is rarely used in real-world deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-9230"
        },
        {
          "category": "external",
          "summary": "RHBZ#2396054",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396054"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-9230",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-9230"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9230",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9230"
        }
      ],
      "release_date": "2025-09-30T23:59:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Paul Holzinger"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2025-9566",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2025-09-04T15:45:46.448000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2393152"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There\u0027s a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file.\n\nBinary-Affected: podman\nUpstream-version-introduced: v4.0.0\nUpstream-version-fixed: v5.6.1",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "podman: Podman kube play command may overwrite host files",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has evaluated this vulnerability as having the Important severity. This happens because of the consequences of an successful attack and the low complexity (AC:L) on exploiting this vulnerability. Although the attacker cannot control the content written to the target file, depending on which file was targeted, the exploitation of this flaw may lead sensitive data corruption (I:H) and leading the system to crash resulting in a Denial of Service attack (A:H).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-9566"
        },
        {
          "category": "external",
          "summary": "RHBZ#2393152",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2393152"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-9566",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-9566"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9566",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9566"
        },
        {
          "category": "external",
          "summary": "https://github.com/containers/podman/commit/43fbde4e665fe6cee6921868f04b7ccd3de5ad89",
          "url": "https://github.com/containers/podman/commit/43fbde4e665fe6cee6921868f04b7ccd3de5ad89"
        },
        {
          "category": "external",
          "summary": "https://github.com/containers/podman/security/advisories/GHSA-wp3j-xq48-xpjw",
          "url": "https://github.com/containers/podman/security/advisories/GHSA-wp3j-xq48-xpjw"
        }
      ],
      "release_date": "2025-09-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "Red Hat advises to not run the podman kube play command with untrusted Kubernetes YAML file as input, additionally review the Kubernetes YAML file before running it through podman may help to catch maliciously crafted secretes or volumes that may be used to exploit this vulnerability.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "podman: Podman kube play command may overwrite host files"
    },
    {
      "cve": "CVE-2025-49794",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2025-06-11T21:33:43.044000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2372373"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the \u003csch:name path=\"...\"/\u003e schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program\u0027s crash using libxml or other possible undefined behaviors.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml: Heap use after free (UAF) leads to Denial of service (DoS)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue was rated with a severity impact of Important by Red Hat Product Security, as libxml can be used to parse XML coming from the network depending on how the program consumes it and uses the library. Additionally, although the initial report shows a crash due to invalid memory access (A:H), other undefined issues that can present data integrity due to the application overwriting sensitive data are not discarded (I:H).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-49794"
        },
        {
          "category": "external",
          "summary": "RHBZ#2372373",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372373"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49794",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-49794"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49794",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49794"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/931",
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/931"
        }
      ],
      "release_date": "2025-06-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation other than avoid processing untrusted XML documents before updating to the libxml version containing the fix.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libxml: Heap use after free (UAF) leads to Denial of service (DoS)"
    },
    {
      "cve": "CVE-2025-49796",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-06-12T00:35:26.470000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2372385"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml: Type confusion leads to Denial of service (DoS)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has evaluated this vulnerability as having an Important security impact, as libxml can be used to parse XML from the network depending on how the program consumes it using the library. Additionally, although the initial report shows a crash due to invalid memory access (A:H), other undefined issues that can present data integrity due to the application overwriting sensitive data are not discarded (I:H).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-49796"
        },
        {
          "category": "external",
          "summary": "RHBZ#2372385",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372385"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49796",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-49796"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49796",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49796"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/933",
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/933"
        }
      ],
      "release_date": "2025-06-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation other than to avoid processing untrusted XML documents if the user is unable/unwilling to update the library.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libxml: Type confusion leads to Denial of service (DoS)"
    },
    {
      "cve": "CVE-2025-54518",
      "cwe": {
        "id": "CWE-1220",
        "name": "Insufficient Granularity of Access Control"
      },
      "discovery_date": "2026-05-15T05:01:27.379831+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477784"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in AMD Zen 2-based processors, affecting components such as the kernel and Xen hypervisor. Improper isolation of shared resources within the CPU operation cache could allow an attacker to corrupt instructions executed at a different privilege level. This could potentially result in privilege escalation, granting an attacker higher system access than intended.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-54518"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477784",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477784"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-54518",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-54518"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-54518",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54518"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/05/12/15",
          "url": "http://www.openwall.com/lists/oss-security/2026/05/12/15"
        },
        {
          "category": "external",
          "summary": "http://xenbits.xen.org/xsa/advisory-490.html",
          "url": "http://xenbits.xen.org/xsa/advisory-490.html"
        },
        {
          "category": "external",
          "summary": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7052.html",
          "url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7052.html"
        }
      ],
      "release_date": "2026-05-15T03:06:30.822000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation"
    },
    {
      "cve": "CVE-2026-1519",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-03-25T14:01:56.586125+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2451305"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND. A remote attacker could exploit this vulnerability by sending a maliciously crafted DNSSEC-validated zone to a BIND resolver. This could cause the resolver to consume excessive CPU resources, leading to a denial of service (DoS) for legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important. A flaw in BIND allows a remote attacker to cause a Denial of Service by sending a maliciously crafted DNSSEC-validated zone to a BIND resolver. Red Hat systems running BIND configured for DNSSEC validation are affected. Authoritative-only BIND servers are generally not impacted unless configured to perform recursive queries.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1519"
        },
        {
          "category": "external",
          "summary": "RHBZ#2451305",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451305"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1519",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1519"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1519",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1519"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.18.47",
          "url": "https://downloads.isc.org/isc/bind9/9.18.47"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.20.21",
          "url": "https://downloads.isc.org/isc/bind9/9.20.21"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.21.20",
          "url": "https://downloads.isc.org/isc/bind9/9.21.20"
        },
        {
          "category": "external",
          "summary": "https://kb.isc.org/docs/cve-2026-1519",
          "url": "https://kb.isc.org/docs/cve-2026-1519"
        }
      ],
      "release_date": "2026-03-25T13:25:19.802000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable DNSSEC validation on affected BIND resolvers. Alternatively, configure the BIND server as authoritative-only if recursive queries are not required. Disabling DNSSEC validation may reduce the security posture of the DNS resolver. A restart of the BIND service (`named`) is required for these changes to take effect and may temporarily interrupt DNS resolution.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Pavel Kohout"
          ],
          "organization": "Aisle Research"
        }
      ],
      "cve": "CVE-2026-2340",
      "cwe": {
        "id": "CWE-280",
        "name": "Improper Handling of Insufficient Permissions or Privileges"
      },
      "discovery_date": "2026-03-13T12:55:04.465000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447318"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Samba\u2019s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "samba: vfs_worm does not block directory modification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate severity because exploitation requires authenticated write access to a Samba share already configured to permit file creation and modification.\n\nThe flaw affects the vfs_worm module, which provides additional immutability protections for files after a configurable grace period. Due to improper handling of rename operations, a user with existing write permissions could overwrite files that should have become immutable under the WORM policy.\n\nThe vulnerability does not bypass underlying filesystem access controls or grant additional privileges beyond those already assigned to the authenticated user. However, because the primary purpose of the vfs_worm module is to protect file integrity, the ability to modify protected files results in a high integrity impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2340"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447318",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447318"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2340",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2340"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2340",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2340"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.samba.org/show_bug.cgi?id=15997",
          "url": "https://bugzilla.samba.org/show_bug.cgi?id=15997"
        }
      ],
      "release_date": "2026-05-27T10:35:47.805000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "Administrators can mitigate this issue by:\n\nSetting read-only permissions on protected files at the underlying filesystem level will prevent modifications.\n\nConfiguring ```worm:grace_period = 0``` (zero or less) in smb.conf will eliminate the writable grace period (will eliminate the window in which the rename can happen), understanding that this may impact workflows requiring multi-step file creation.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "samba: vfs_worm does not block directory modification"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Arad Inbar",
            "Nir Somech",
            "Ben Grinberg"
          ],
          "organization": "DREAM Security Research Team"
        },
        {
          "names": [
            "Michalis Vasileiadis"
          ]
        }
      ],
      "cve": "CVE-2026-3012",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2026-03-13T12:55:02.623000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447319"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Samba\u2019s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "samba: group policy certificate enrollment uses http:// without validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has rated this vulnerability as Important severity. \n\nHowever, exploitation requires several specific non-default conditions to be met. The vulnerable code path is only reachable when Samba Group Policy processing is explicitly enabled using the ```apply group policies = yes``` configuration option and certificate auto-enrollment is configured through Group Policy.\n\nHence, although the vulnerable code is present, it is not exploitable in default RHEL configurations. \n\nIn addition, the attacker must have the ability to intercept or redirect adjacent-network HTTP traffic during certificate retrieval. Because exploitation depends on explicit administrative configuration changes and adjacent-network positioning, Red Hat assesses the attack complexity as High (AC:H).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3012"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447319",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447319"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3012",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3012"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3012",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3012"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.samba.org/show_bug.cgi?id=16003",
          "url": "https://bugzilla.samba.org/show_bug.cgi?id=16003"
        }
      ],
      "release_date": "2026-05-27T09:17:49.862000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "Systems are not affected unless Samba Group Policy processing and certificate auto-enrollment are explicitly enabled.\n\nAdministrators can reduce exposure by:\n\nAvoiding unnecessary use of certificate auto-enrollment.\nEnsuring your \"smb.conf\" does not contain a line like ```apply group policies = yes```. If , group policy is not be enabled, the vulnerable code will not run.\n\nIntercepting the HTTP request requires some control over the local network or other devices to intercept or redirect traffic. Some network administrators might assess this as a low risk on their\nnetworks.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "samba: group policy certificate enrollment uses http:// without validation"
    },
    {
      "cve": "CVE-2026-3039",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-19T09:48:19.212000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479767"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending maliciously-constructed packets to BIND servers configured for TKEY-based authentication via GSS-API (Generic Security Service Application Program Interface) tokens. This can lead to excessive memory consumption, resulting in a Denial of Service (DoS) for the affected server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: BIND servers configured for TKEY-based GSS-API authentication are vulnerable to memory exhaustion when processing maliciously-constructed packets. This can lead to a denial of service, specifically impacting Red Hat deployments integrated with Active Directory or Kerberos for DNS where this authentication method is enabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3039"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479767",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479767"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3039",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3039"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3039",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3039"
        }
      ],
      "release_date": "2026-05-21T12:24:11.051000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\nExample:\n```bash\n# Edit /etc/named.conf and remove or comment out lines related to tkey-gssapi-keytab or tkey-gssapi-credential.\n# For example, remove or comment out:\n# key \"gssapi-key\" {\n#     algorithm GSSAPI;\n#     secret \"BASE64_ENCODED_KEY\";\n# };\n#\n# Then reload the named service:\nsystemctl reload named\n```\nReloading the `named` service may cause a brief interruption in DNS resolution.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation"
    },
    {
      "cve": "CVE-2026-3833",
      "cwe": {
        "id": "CWE-178",
        "name": "Improper Handling of Case Sensitivity"
      },
      "discovery_date": "2026-03-09T14:02:09.783000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445763"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is particularly important because it affects the correct enforcement of X.509 nameConstraints, which are specifically designed to limit the authority of subordinate CAs. In GnuTLS, the use of case-sensitive comparisons (memcmp) for dNSName and the domain portion of rfc822Name violates the case-insensitive matching requirements defined in RFC 5280 and RFC 4343. As a result, a constrained subordinate CA can bypass excludedSubtrees or permittedSubtrees restrictions simply by changing the letter casing of a domain in the SAN (e.g., ExAmPlE.CoM vs example.com). Since nameConstraints are often the only mechanism enforcing domain boundaries in delegated PKI hierarchies, this flaw effectively allows a malicious or compromised sub-CA to issue certificates for domains that should be cryptographically prohibited, enabling unauthorized certificate validation and potential TLS impersonation of restricted services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3833"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445763",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3833",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3833"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3833",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3833"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/gnutls/gnutls/-/issues/1803",
          "url": "https://gitlab.com/gnutls/gnutls/-/issues/1803"
        }
      ],
      "release_date": "2026-04-30T17:26:28.969000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison"
    },
    {
      "cve": "CVE-2026-5946",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-05-19T09:57:49.705000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479771"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the bind component, specifically within the `named` daemon. This vulnerability allows a remote attacker to send specially crafted Domain Name System (DNS) messages. These messages, which use unusual classes or meta-classes, can trigger assertion failures in the `named` daemon when processed. Successful exploitation leads to an application level Denial of Service (DoS), making the DNS service unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: BIND: Denial of Service via specially crafted DNS messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is rated as an Important denial of service vulnerability. The `named` daemon is susceptible to crashes when processing specially crafted DNS messages that utilize non-Internet (IN) classes or meta-classes. This can lead to service unavailability if an attacker sends malicious requests targeting recursion, dynamic updates, zone change notifications, or specific record type processing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5946"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479771",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479771"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5946",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5946"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5946",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5946"
        }
      ],
      "release_date": "2026-05-21T12:32:55.602000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: BIND: Denial of Service via specially crafted DNS messages"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "AISLE Research"
          ]
        }
      ],
      "cve": "CVE-2026-6893",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-04-21T02:37:23+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2459963"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut\u0027s legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system\u0027s boot and network behavior.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dracut: dracut: Root code execution via DHCP options command injection",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability in dracut\u0027s legacy DHCP client script (`dhclient-script.sh`) that allows command injection. An attacker on the adjacent network can exploit this by providing specially crafted DHCP options, leading to root code execution within the initramfs. This primarily affects systems configured to use DHCP for network setup during the initial boot phase.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6893"
        },
        {
          "category": "external",
          "summary": "RHBZ#2459963",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6893",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6893"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6893",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6893"
        }
      ],
      "release_date": "2026-06-10T19:39:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that systems configured to obtain network settings via DHCP in the initramfs are only booted on trusted networks. This vulnerability requires an attacker to control a DHCP server on the adjacent network segment. If network configuration via DHCP is not strictly necessary during the initramfs phase, consider using static network configuration.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dracut: dracut: Root code execution via DHCP options command injection"
    },
    {
      "cve": "CVE-2026-10723",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2026-07-21T21:13:55.893000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504560"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: bind9: Incorrect acceptance of NSEC3 records",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in BIND allows an attacker to forge authenticated NXDOMAIN responses for sibling zones due to incorrect validation of child-zone NSEC3 records. Exploitation requires high attack complexity, limiting the immediate risk to Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-10723"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504560",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504560"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-10723",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-10723"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10723",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10723"
        }
      ],
      "release_date": "2026-07-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "bind: bind9: Incorrect acceptance of NSEC3 records"
    },
    {
      "cve": "CVE-2026-11331",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2026-07-21T16:15:37.317000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503721"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND 9, a widely used Domain Name System (DNS) software. A remote attacker could exploit this by sending specially crafted, excessively long DNS queries. This could bypass Response Policy Zone (RPZ) rules, which are designed to block access to malicious domains, and potentially cause the BIND 9 software to crash, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind9: bind: Potential wildcard CNAME RPZ policy bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11331"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503721",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503721"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11331",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11331"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11331",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11331"
        }
      ],
      "release_date": "2026-07-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind9: bind: Potential wildcard CNAME RPZ policy bypass"
    },
    {
      "cve": "CVE-2026-13321",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2026-07-21T19:40:30.464000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504166"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer\u0027s zone.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An attacker controlling any DNSSEC-signed zone can craft NSEC records that span into victim zones, enabling cross-zone cache poisoning with authenticated denial-of-service responses (AD=1).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13321"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504166",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504166"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13321",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13321"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13321",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13321"
        }
      ],
      "release_date": "2026-07-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "Disclaimer: The following mitigation notes are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nISC states no workarounds exist. Until patched, restrict the resolver to authorized client networks and deploy separate resolvers per trust zone. Memory hardening and auth controls don\u0027t apply \u2014 this is a DNS protocol logic error using validly-signed records.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Pavel Valena"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-15816",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-06-10T19:21:21+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500889"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates this flaw\u0027s impact as Important. Exploitation requires an attacker-controlled or spoofed DHCP server on the same network segment as a system performing network boot (root=dhcp/netroot=dhcp), and for the DHCP-supplied ROOT_PATH value to fail dracut\u0027s netroot handler resolution -- both fully within an adjacent-network attacker\u0027s control. Reaching the point where the poisoned hook script is actually sourced depends on dracut\u0027s boot-failure handling reinvoking the emergency shell mechanism, which occurs by default when the netroot handler cannot be resolved. This is a separate code path from CVE-2026-6893, which patched modules.d/35network-legacy/dhclient-script.sh but did not modify dracut-lib.sh\u0027s die() function. Systems that do not perform network/PXE boot, or that do not rely on DHCP-supplied ROOT_PATH values, are not exposed to this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15816"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500889",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500889"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15816",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15816"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15816",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15816"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963"
        },
        {
          "category": "external",
          "summary": "https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh",
          "url": "https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh"
        },
        {
          "category": "external",
          "summary": "https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh",
          "url": "https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh"
        }
      ],
      "release_date": "2026-08-05T23:59:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "Restrict DHCP server access on networks used for network boot (DHCP snooping, dedicated/trusted provisioning VLANs) until a fix is available.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()"
    },
    {
      "cve": "CVE-2026-29111",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-03-23T22:01:54.593547+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2450505"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-29111"
        },
        {
          "category": "external",
          "summary": "RHBZ#2450505",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450505"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-29111",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-29111"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a",
          "url": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
          "url": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412",
          "url": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd",
          "url": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f",
          "url": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f",
          "url": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69",
          "url": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6",
          "url": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c",
          "url": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8",
          "url": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764",
          "url": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764"
        }
      ],
      "release_date": "2026-03-23T21:03:56.120000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data"
    },
    {
      "cve": "CVE-2026-39821",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-05-22T16:00:52.844126+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480756"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480756",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/767220",
          "url": "https://go.dev/cl/767220"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78760",
          "url": "https://go.dev/issue/78760"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5026",
          "url": "https://pkg.go.dev/vuln/GO-2026-5026"
        }
      ],
      "release_date": "2026-05-22T15:01:21.462000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        },
        {
          "category": "workaround",
          "details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "cve": "CVE-2026-43112",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-05-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467015"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s CIFS (Common Internet File System) client. When the `cifs_sanitize_prepath` function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-bounds read can lead to a system crash, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important out-of-bounds read flaw in the Linux kernel\u0027s CIFS client can lead to a system crash and denial of service. This vulnerability, present in Red Hat Enterprise Linux 8, 9, and 10, and Red Hat In-Vehicle OS 2, can be triggered by processing specially crafted input to the `cifs_sanitize_prepath` function, potentially disrupting system availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43112"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467015",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467015"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43112",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43112"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43112",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43112"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026050625-CVE-2026-43112-f37f@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026050625-CVE-2026-43112-f37f@gregkh/T"
        }
      ],
      "release_date": "2026-05-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T09:01:14+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:077bb2d0f053cfadc673374237b206740ab78f2663d3dbd1b49713c2ced88994\n\n      (For s390x architecture)\n      The image digest is sha256:a46bf8cdae866571521a66b6efa1634db5109b020ab9ed6d8de1caf815bfe25a\n\n      (For ppc64le architecture)\n      The image digest is sha256:6e0b33f7d8db91651807aabffce25e1cdf27f90a6240ac49bd651c64b05464c3\n\n      (For aarch64 architecture)\n      The image digest is sha256:e76b87d63f7b8b2960353d5cc3e7bf427b65edd8e95c8c51fbb7c12a6ea4fb34\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62549"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609011112-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609011112-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath"
    }
  ]
}