Vulnerability-Lookup

RHSA-2026:68335

Vulnerability from csaf_redhat - Published: 2026-09-16 18:05 - Updated: 2026-09-17 07:38

Summary

Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.1 Security Update

Severity

Important

Notes

Topic: Red Hat Edge Manager Version 1.2.1 Security Update

Details: Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused management of edge devices and applications. It supports image-mode RHEL and container workloads that run on Podman/Docker or Kubernetes. RHEM is now available as a standalone feature, providing greater flexibility for edge deployments. In addition to the standalone version, RHEM continues to be offered as a plugin for the following platforms: Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge devices. Red Hat Ansible Automation Platform (AAP): Integrates edge management with Ansible automation. This integration enables organizations to optimize the management and orchestration of their fleets of edge devices; whether its thousands of dispersed retail point-of-sale systems or industrial machinery on remote factory floors. Value for customers and partners: * This solution not only helps customers manage thousands of devices but helps scale operations. * To manage large-scale deployments, customers need to be able to integrate with their existing management systems, support remote configuration and over-the-air updates, and collect telemetry data for advanced analytics. * Red Hat Edge Manager offers a simple and security-focused lifecycle management, from onboarding to decommissioning of edge devices. This complete end-to-end solution empowers organizations to gain the most value from the fleets of devices that generate data, all from a centralized location. Security Fixes: * flightctl: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) * flightctl: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * flightctl: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * flightctl: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740) * flightctl: Arc: Information disclosure and Denial of Service via unauthenticated debug endpoints (CVE-2026-48050) * flightctl: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852) * flightctl: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * flightctl: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * flightctl: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) * flightctl: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * flightctl: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * flightctl: go-git: Arbitrary file read/write via symbolic link resolution (CVE-2026-71556)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-27145

A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-606 - Unchecked Input for Loop Condition

Affected products

Fixed 18 products

Product	Version	Remediation
Unresolved product id: 10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64	—	Vendor Fix fix Workaround

Known not affected 18 products

Product	Version	Remediation
Unresolved product id: 10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64	—	Workaround
Unresolved product id: 10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le	—	Workaround
Unresolved product id: 10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x	—	Workaround
Unresolved product id: 10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64	—	Workaround
Unresolved product id: 10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch	—	Workaround
Unresolved product id: 10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64	—	Workaround
Unresolved product id: 10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le	—	Workaround
Unresolved product id: 10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x	—	Workaround
Unresolved product id: 10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64	—	Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64	—	Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le	—	Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x	—	Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64	—	Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch	—	Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64	—	Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le	—	Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x	—	Workaround
Unresolved product id: 9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64	—	Workaround

Threats

Impact Important

CVE-2026-33818

A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Affected products

Fixed 18 products, the same list as for CVE-2026-27145

Known not affected 18 products, the same list as for CVE-2026-27145

Threats

Impact Important

CVE-2026-41178

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 18 products, the same list as for CVE-2026-27145

Known not affected 18 products, the same list as for CVE-2026-27145

Threats

Impact Important

CVE-2026-44740

A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation and missing safety mechanisms when processing untrusted repository data and filesystem structures, leading to panics, infinite loops, uncontrolled recursion, or excessive resource consumption.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-606 - Unchecked Input for Loop Condition

Affected products

Fixed 18 products, the same list as for CVE-2026-27145

Known not affected 18 products, the same list as for CVE-2026-27145

Threats

Impact Important

CVE-2026-48050

A flaw was found in Arc. This vulnerability allows a remote unauthenticated attacker to access Go debug pprof endpoints due to improper authentication bypass. Successful exploitation can lead to the disclosure of sensitive runtime state information and enable a CPU-burn Denial of Service (DoS) attack, impacting the availability and confidentiality of the system.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Affected products

Fixed 18 products, the same list as for CVE-2026-27145

Known not affected 18 products, the same list as for CVE-2026-27145

Threats

Impact Important

CVE-2026-56852

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 18 products, the same list as for CVE-2026-27145

Known not affected 18 products, the same list as for CVE-2026-27145

Threats

Impact Important

CVE-2026-56853

A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 18 products, the same list as for CVE-2026-27145

Known not affected 18 products, the same list as for CVE-2026-27145

Threats

Impact Important

CVE-2026-56858

A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 18 products, the same list as for CVE-2026-27145

Known not affected 18 products, the same list as for CVE-2026-27145

Threats

Impact Important

CVE-2026-56859

A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Affected products

Fixed 18 products, the same list as for CVE-2026-27145

Known not affected 18 products, the same list as for CVE-2026-27145

Threats

Impact Important

CVE-2026-56860

A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 18 products, the same list as for CVE-2026-27145

Known not affected 18 products, the same list as for CVE-2026-27145

Threats

Impact Important

CVE-2026-56862

A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 18 products, the same list as for CVE-2026-27145

Known not affected 18 products, the same list as for CVE-2026-27145

Threats

Impact Important

CVE-2026-71556

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink, which, when cloned and its worktree operations are used, can lead to reading from or writing to arbitrary files outside the intended working directory. This could result in information disclosure or arbitrary file modification.

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Affected products

Fixed 18 products, the same list as for CVE-2026-27145

Known not affected 18 products, the same list as for CVE-2026-27145

Threats

Impact Important

References

96 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:68335	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2483894	external
https://bugzilla.redhat.com/show_bug.cgi?id=2484207	external
https://bugzilla.redhat.com/show_bug.cgi?id=2484830	external
https://bugzilla.redhat.com/show_bug.cgi?id=2504233	external
https://bugzilla.redhat.com/show_bug.cgi?id=2512562	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515815	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515820	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515827	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515838	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515839	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515840	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-27145	self
https://bugzilla.redhat.com/show_bug.cgi?id=2484207	external
https://www.cve.org/CVERecord?id=CVE-2026-27145	external
https://nvd.nist.gov/vuln/detail/CVE-2026-27145	external
https://go.dev/cl/783621	external
https://go.dev/issue/79694	external
https://groups.google.com/g/golang-announce/c/tKs…	external
https://pkg.go.dev/vuln/GO-2026-5037	external
https://access.redhat.com/security/cve/CVE-2026-33818	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515815	external
https://www.cve.org/CVERecord?id=CVE-2026-33818	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33818	external
https://go.dev/cl/814980	external
https://go.dev/issue/80405	external
https://groups.google.com/g/golang-announce/c/94p…	external
https://pkg.go.dev/vuln/GO-2026-5972	external
https://access.redhat.com/security/cve/CVE-2026-41178	self
https://bugzilla.redhat.com/show_bug.cgi?id=2484830	external
https://www.cve.org/CVERecord?id=CVE-2026-41178	external
https://nvd.nist.gov/vuln/detail/CVE-2026-41178	external
https://github.com/open-telemetry/opentelemetry-g…	external
https://github.com/open-telemetry/opentelemetry-g…	external
https://access.redhat.com/security/cve/CVE-2026-44740	self
https://bugzilla.redhat.com/show_bug.cgi?id=2483894	external
https://www.cve.org/CVERecord?id=CVE-2026-44740	external
https://nvd.nist.gov/vuln/detail/CVE-2026-44740	external
https://github.com/go-git/go-billy/releases/tag/v5.9.0	external
https://github.com/go-git/go-billy/releases/tag/v…	external
https://github.com/go-git/go-billy/security/advis…	external
https://access.redhat.com/security/cve/CVE-2026-48050	self
https://www.cve.org/CVERecord?id=CVE-2026-48050	external
https://access.redhat.com/security/cve/CVE-2026-56852	self
https://bugzilla.redhat.com/show_bug.cgi?id=2504233	external
https://www.cve.org/CVERecord?id=CVE-2026-56852	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56852	external
https://go.dev/cl/794100	external
https://go.dev/issue/80142	external
https://pkg.go.dev/vuln/GO-2026-5970	external
https://access.redhat.com/security/cve/CVE-2026-56853	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515827	external
https://www.cve.org/CVERecord?id=CVE-2026-56853	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56853	external
https://go.dev/cl/795540	external
https://go.dev/issue/80205	external
https://pkg.go.dev/vuln/GO-2026-6089	external
https://access.redhat.com/security/cve/CVE-2026-56858	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515838	external
https://www.cve.org/CVERecord?id=CVE-2026-56858	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56858	external
https://go.dev/cl/807100	external
https://go.dev/issue/80435	external
https://pkg.go.dev/vuln/GO-2026-6091	external
https://access.redhat.com/security/cve/CVE-2026-56859	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515840	external
https://www.cve.org/CVERecord?id=CVE-2026-56859	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56859	external
https://go.dev/cl/803320	external
https://go.dev/issue/80481	external
https://pkg.go.dev/vuln/GO-2026-6088	external
https://access.redhat.com/security/cve/CVE-2026-56860	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515820	external
https://www.cve.org/CVERecord?id=CVE-2026-56860	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56860	external
https://go.dev/cl/803681	external
https://go.dev/issue/80494	external
https://pkg.go.dev/vuln/GO-2026-6218	external
https://access.redhat.com/security/cve/CVE-2026-56862	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515839	external
https://www.cve.org/CVERecord?id=CVE-2026-56862	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56862	external
https://go.dev/cl/804261	external
https://go.dev/issue/80528	external
https://pkg.go.dev/vuln/GO-2026-6090	external
https://access.redhat.com/security/cve/CVE-2026-71556	self
https://bugzilla.redhat.com/show_bug.cgi?id=2512562	external
https://www.cve.org/CVERecord?id=CVE-2026-71556	external
https://nvd.nist.gov/vuln/detail/CVE-2026-71556	external
https://github.com/go-git/go-git/commit/008a78f2d…	external
https://github.com/go-git/go-git/commit/661d1c7f1…	external
https://github.com/go-git/go-git/releases/tag/v5.19.2	external
https://github.com/go-git/go-git/releases/tag/v6.…	external
https://github.com/go-git/go-git/security/advisor…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Edge Manager Version 1.2.1 Security Update",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused\nmanagement of edge devices and applications. It supports image-mode RHEL and\ncontainer workloads that run on Podman/Docker or Kubernetes.\n\nRHEM is now available as a standalone feature, providing greater flexibility for\nedge deployments. In addition to the standalone version, RHEM continues to be\noffered as a plugin for the following platforms:\n\nRed Hat Advanced Cluster Management (RHACM): Extends fleet management to edge\ndevices.\nRed Hat Ansible Automation Platform (AAP): Integrates edge management with\nAnsible automation.\n\nThis integration enables organizations to optimize the management and\norchestration of their fleets of edge devices; whether its thousands of\ndispersed retail point-of-sale systems or industrial machinery on remote factory\nfloors.\n\nValue for customers and partners:\n\n* This solution not only helps customers manage thousands of devices but helps\nscale operations.\n* To manage large-scale deployments, customers need to be able to integrate with\ntheir existing management systems, support remote configuration and over-the-air\nupdates, and collect telemetry data for advanced analytics.\n* Red Hat Edge Manager offers a simple and security-focused lifecycle\nmanagement, from onboarding to decommissioning of edge devices.\n\nThis complete end-to-end solution empowers organizations to gain the most value\nfrom the fleets of devices that generate data, all from a centralized location.\n\nSecurity Fixes: \n\n* flightctl: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)\n* flightctl: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n* flightctl: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)\n* flightctl: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)\n* flightctl: Arc: Information disclosure and Denial of Service via unauthenticated debug endpoints (CVE-2026-48050)\n* flightctl: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)\n* flightctl: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)\n* flightctl: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)\n* flightctl: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)\n* flightctl: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n* flightctl: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)\n* flightctl: go-git: Arbitrary file read/write via symbolic link resolution (CVE-2026-71556)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:68335",
        "url": "https://access.redhat.com/errata/RHSA-2026:68335"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2483894",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483894"
      },
      {
        "category": "external",
        "summary": "2484207",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
      },
      {
        "category": "external",
        "summary": "2484830",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484830"
      },
      {
        "category": "external",
        "summary": "2504233",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
      },
      {
        "category": "external",
        "summary": "2512562",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512562"
      },
      {
        "category": "external",
        "summary": "2515815",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
      },
      {
        "category": "external",
        "summary": "2515820",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
      },
      {
        "category": "external",
        "summary": "2515827",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827"
      },
      {
        "category": "external",
        "summary": "2515838",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838"
      },
      {
        "category": "external",
        "summary": "2515839",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839"
      },
      {
        "category": "external",
        "summary": "2515840",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68335.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.1 Security Update",
    "tracking": {
      "current_release_date": "2026-09-17T07:38:29+00:00",
      "generator": {
        "date": "2026-09-17T07:38:29+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.21"
        }
      },
      "id": "RHSA-2026:68335",
      "initial_release_date": "2026-09-16T18:05:10+00:00",
      "revision_history": [
        {
          "date": "2026-09-16T18:05:10+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-16T18:05:10+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-17T07:38:29+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHEM 1.2 for RHEL 10",
                "product": {
                  "name": "RHEM 1.2 for RHEL 10",
                  "product_id": "10Base-RHEM-1.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:edge_manager:1.2::el10"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "RHEM 1.2 for RHEL 9",
                "product": {
                  "name": "RHEM 1.2 for RHEL 9",
                  "product_id": "9Base-RHEM-1.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:edge_manager:1.2::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Edge Manager"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "flightctl-0:1.2.1-1.el10.src",
                "product": {
                  "name": "flightctl-0:1.2.1-1.el10.src",
                  "product_id": "flightctl-0:1.2.1-1.el10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl@1.2.1-1.el10?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-0:1.2.1-1.el9.src",
                "product": {
                  "name": "flightctl-0:1.2.1-1.el9.src",
                  "product_id": "flightctl-0:1.2.1-1.el9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl@1.2.1-1.el9?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "flightctl-agent-0:1.2.1-1.el10.x86_64",
                "product": {
                  "name": "flightctl-agent-0:1.2.1-1.el10.x86_64",
                  "product_id": "flightctl-agent-0:1.2.1-1.el10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-agent@1.2.1-1.el10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-cli-0:1.2.1-1.el10.x86_64",
                "product": {
                  "name": "flightctl-cli-0:1.2.1-1.el10.x86_64",
                  "product_id": "flightctl-cli-0:1.2.1-1.el10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-cli@1.2.1-1.el10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-observability-0:1.2.1-1.el10.x86_64",
                "product": {
                  "name": "flightctl-observability-0:1.2.1-1.el10.x86_64",
                  "product_id": "flightctl-observability-0:1.2.1-1.el10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-observability@1.2.1-1.el10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-services-0:1.2.1-1.el10.x86_64",
                "product": {
                  "name": "flightctl-services-0:1.2.1-1.el10.x86_64",
                  "product_id": "flightctl-services-0:1.2.1-1.el10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-services@1.2.1-1.el10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-agent-0:1.2.1-1.el9.x86_64",
                "product": {
                  "name": "flightctl-agent-0:1.2.1-1.el9.x86_64",
                  "product_id": "flightctl-agent-0:1.2.1-1.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-agent@1.2.1-1.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-cli-0:1.2.1-1.el9.x86_64",
                "product": {
                  "name": "flightctl-cli-0:1.2.1-1.el9.x86_64",
                  "product_id": "flightctl-cli-0:1.2.1-1.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-cli@1.2.1-1.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-observability-0:1.2.1-1.el9.x86_64",
                "product": {
                  "name": "flightctl-observability-0:1.2.1-1.el9.x86_64",
                  "product_id": "flightctl-observability-0:1.2.1-1.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-observability@1.2.1-1.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-services-0:1.2.1-1.el9.x86_64",
                "product": {
                  "name": "flightctl-services-0:1.2.1-1.el9.x86_64",
                  "product_id": "flightctl-services-0:1.2.1-1.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-services@1.2.1-1.el9?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "flightctl-agent-0:1.2.1-1.el10.s390x",
                "product": {
                  "name": "flightctl-agent-0:1.2.1-1.el10.s390x",
                  "product_id": "flightctl-agent-0:1.2.1-1.el10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-agent@1.2.1-1.el10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-cli-0:1.2.1-1.el10.s390x",
                "product": {
                  "name": "flightctl-cli-0:1.2.1-1.el10.s390x",
                  "product_id": "flightctl-cli-0:1.2.1-1.el10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-cli@1.2.1-1.el10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-observability-0:1.2.1-1.el10.s390x",
                "product": {
                  "name": "flightctl-observability-0:1.2.1-1.el10.s390x",
                  "product_id": "flightctl-observability-0:1.2.1-1.el10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-observability@1.2.1-1.el10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-services-0:1.2.1-1.el10.s390x",
                "product": {
                  "name": "flightctl-services-0:1.2.1-1.el10.s390x",
                  "product_id": "flightctl-services-0:1.2.1-1.el10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-services@1.2.1-1.el10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-agent-0:1.2.1-1.el9.s390x",
                "product": {
                  "name": "flightctl-agent-0:1.2.1-1.el9.s390x",
                  "product_id": "flightctl-agent-0:1.2.1-1.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-agent@1.2.1-1.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-cli-0:1.2.1-1.el9.s390x",
                "product": {
                  "name": "flightctl-cli-0:1.2.1-1.el9.s390x",
                  "product_id": "flightctl-cli-0:1.2.1-1.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-cli@1.2.1-1.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-observability-0:1.2.1-1.el9.s390x",
                "product": {
                  "name": "flightctl-observability-0:1.2.1-1.el9.s390x",
                  "product_id": "flightctl-observability-0:1.2.1-1.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-observability@1.2.1-1.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-services-0:1.2.1-1.el9.s390x",
                "product": {
                  "name": "flightctl-services-0:1.2.1-1.el9.s390x",
                  "product_id": "flightctl-services-0:1.2.1-1.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-services@1.2.1-1.el9?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "flightctl-agent-0:1.2.1-1.el10.ppc64le",
                "product": {
                  "name": "flightctl-agent-0:1.2.1-1.el10.ppc64le",
                  "product_id": "flightctl-agent-0:1.2.1-1.el10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-agent@1.2.1-1.el10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-cli-0:1.2.1-1.el10.ppc64le",
                "product": {
                  "name": "flightctl-cli-0:1.2.1-1.el10.ppc64le",
                  "product_id": "flightctl-cli-0:1.2.1-1.el10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-cli@1.2.1-1.el10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-observability-0:1.2.1-1.el10.ppc64le",
                "product": {
                  "name": "flightctl-observability-0:1.2.1-1.el10.ppc64le",
                  "product_id": "flightctl-observability-0:1.2.1-1.el10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-observability@1.2.1-1.el10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-services-0:1.2.1-1.el10.ppc64le",
                "product": {
                  "name": "flightctl-services-0:1.2.1-1.el10.ppc64le",
                  "product_id": "flightctl-services-0:1.2.1-1.el10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-services@1.2.1-1.el10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-agent-0:1.2.1-1.el9.ppc64le",
                "product": {
                  "name": "flightctl-agent-0:1.2.1-1.el9.ppc64le",
                  "product_id": "flightctl-agent-0:1.2.1-1.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-agent@1.2.1-1.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-cli-0:1.2.1-1.el9.ppc64le",
                "product": {
                  "name": "flightctl-cli-0:1.2.1-1.el9.ppc64le",
                  "product_id": "flightctl-cli-0:1.2.1-1.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-cli@1.2.1-1.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-observability-0:1.2.1-1.el9.ppc64le",
                "product": {
                  "name": "flightctl-observability-0:1.2.1-1.el9.ppc64le",
                  "product_id": "flightctl-observability-0:1.2.1-1.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-observability@1.2.1-1.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-services-0:1.2.1-1.el9.ppc64le",
                "product": {
                  "name": "flightctl-services-0:1.2.1-1.el9.ppc64le",
                  "product_id": "flightctl-services-0:1.2.1-1.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-services@1.2.1-1.el9?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "flightctl-agent-0:1.2.1-1.el10.aarch64",
                "product": {
                  "name": "flightctl-agent-0:1.2.1-1.el10.aarch64",
                  "product_id": "flightctl-agent-0:1.2.1-1.el10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-agent@1.2.1-1.el10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-cli-0:1.2.1-1.el10.aarch64",
                "product": {
                  "name": "flightctl-cli-0:1.2.1-1.el10.aarch64",
                  "product_id": "flightctl-cli-0:1.2.1-1.el10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-cli@1.2.1-1.el10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-observability-0:1.2.1-1.el10.aarch64",
                "product": {
                  "name": "flightctl-observability-0:1.2.1-1.el10.aarch64",
                  "product_id": "flightctl-observability-0:1.2.1-1.el10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-observability@1.2.1-1.el10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-services-0:1.2.1-1.el10.aarch64",
                "product": {
                  "name": "flightctl-services-0:1.2.1-1.el10.aarch64",
                  "product_id": "flightctl-services-0:1.2.1-1.el10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-services@1.2.1-1.el10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-agent-0:1.2.1-1.el9.aarch64",
                "product": {
                  "name": "flightctl-agent-0:1.2.1-1.el9.aarch64",
                  "product_id": "flightctl-agent-0:1.2.1-1.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-agent@1.2.1-1.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-cli-0:1.2.1-1.el9.aarch64",
                "product": {
                  "name": "flightctl-cli-0:1.2.1-1.el9.aarch64",
                  "product_id": "flightctl-cli-0:1.2.1-1.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-cli@1.2.1-1.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-observability-0:1.2.1-1.el9.aarch64",
                "product": {
                  "name": "flightctl-observability-0:1.2.1-1.el9.aarch64",
                  "product_id": "flightctl-observability-0:1.2.1-1.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-observability@1.2.1-1.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-services-0:1.2.1-1.el9.aarch64",
                "product": {
                  "name": "flightctl-services-0:1.2.1-1.el9.aarch64",
                  "product_id": "flightctl-services-0:1.2.1-1.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-services@1.2.1-1.el9?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "flightctl-selinux-0:1.2.1-1.el10.noarch",
                "product": {
                  "name": "flightctl-selinux-0:1.2.1-1.el10.noarch",
                  "product_id": "flightctl-selinux-0:1.2.1-1.el10.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-selinux@1.2.1-1.el10?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flightctl-selinux-0:1.2.1-1.el9.noarch",
                "product": {
                  "name": "flightctl-selinux-0:1.2.1-1.el9.noarch",
                  "product_id": "flightctl-selinux-0:1.2.1-1.el9.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/flightctl-selinux@1.2.1-1.el9?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-0:1.2.1-1.el10.src as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src"
        },
        "product_reference": "flightctl-0:1.2.1-1.el10.src",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-agent-0:1.2.1-1.el10.aarch64 as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64"
        },
        "product_reference": "flightctl-agent-0:1.2.1-1.el10.aarch64",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-agent-0:1.2.1-1.el10.ppc64le as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le"
        },
        "product_reference": "flightctl-agent-0:1.2.1-1.el10.ppc64le",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-agent-0:1.2.1-1.el10.s390x as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x"
        },
        "product_reference": "flightctl-agent-0:1.2.1-1.el10.s390x",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-agent-0:1.2.1-1.el10.x86_64 as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64"
        },
        "product_reference": "flightctl-agent-0:1.2.1-1.el10.x86_64",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-cli-0:1.2.1-1.el10.aarch64 as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64"
        },
        "product_reference": "flightctl-cli-0:1.2.1-1.el10.aarch64",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-cli-0:1.2.1-1.el10.ppc64le as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le"
        },
        "product_reference": "flightctl-cli-0:1.2.1-1.el10.ppc64le",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-cli-0:1.2.1-1.el10.s390x as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x"
        },
        "product_reference": "flightctl-cli-0:1.2.1-1.el10.s390x",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-cli-0:1.2.1-1.el10.x86_64 as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64"
        },
        "product_reference": "flightctl-cli-0:1.2.1-1.el10.x86_64",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-observability-0:1.2.1-1.el10.aarch64 as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64"
        },
        "product_reference": "flightctl-observability-0:1.2.1-1.el10.aarch64",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-observability-0:1.2.1-1.el10.ppc64le as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le"
        },
        "product_reference": "flightctl-observability-0:1.2.1-1.el10.ppc64le",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-observability-0:1.2.1-1.el10.s390x as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x"
        },
        "product_reference": "flightctl-observability-0:1.2.1-1.el10.s390x",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-observability-0:1.2.1-1.el10.x86_64 as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64"
        },
        "product_reference": "flightctl-observability-0:1.2.1-1.el10.x86_64",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-selinux-0:1.2.1-1.el10.noarch as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch"
        },
        "product_reference": "flightctl-selinux-0:1.2.1-1.el10.noarch",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-services-0:1.2.1-1.el10.aarch64 as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64"
        },
        "product_reference": "flightctl-services-0:1.2.1-1.el10.aarch64",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-services-0:1.2.1-1.el10.ppc64le as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le"
        },
        "product_reference": "flightctl-services-0:1.2.1-1.el10.ppc64le",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-services-0:1.2.1-1.el10.s390x as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x"
        },
        "product_reference": "flightctl-services-0:1.2.1-1.el10.s390x",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-services-0:1.2.1-1.el10.x86_64 as a component of RHEM 1.2 for RHEL 10",
          "product_id": "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64"
        },
        "product_reference": "flightctl-services-0:1.2.1-1.el10.x86_64",
        "relates_to_product_reference": "10Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-0:1.2.1-1.el9.src as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src"
        },
        "product_reference": "flightctl-0:1.2.1-1.el9.src",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-agent-0:1.2.1-1.el9.aarch64 as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64"
        },
        "product_reference": "flightctl-agent-0:1.2.1-1.el9.aarch64",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-agent-0:1.2.1-1.el9.ppc64le as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le"
        },
        "product_reference": "flightctl-agent-0:1.2.1-1.el9.ppc64le",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-agent-0:1.2.1-1.el9.s390x as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x"
        },
        "product_reference": "flightctl-agent-0:1.2.1-1.el9.s390x",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-agent-0:1.2.1-1.el9.x86_64 as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64"
        },
        "product_reference": "flightctl-agent-0:1.2.1-1.el9.x86_64",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-cli-0:1.2.1-1.el9.aarch64 as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64"
        },
        "product_reference": "flightctl-cli-0:1.2.1-1.el9.aarch64",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-cli-0:1.2.1-1.el9.ppc64le as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le"
        },
        "product_reference": "flightctl-cli-0:1.2.1-1.el9.ppc64le",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-cli-0:1.2.1-1.el9.s390x as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x"
        },
        "product_reference": "flightctl-cli-0:1.2.1-1.el9.s390x",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-cli-0:1.2.1-1.el9.x86_64 as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
        },
        "product_reference": "flightctl-cli-0:1.2.1-1.el9.x86_64",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-observability-0:1.2.1-1.el9.aarch64 as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64"
        },
        "product_reference": "flightctl-observability-0:1.2.1-1.el9.aarch64",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-observability-0:1.2.1-1.el9.ppc64le as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le"
        },
        "product_reference": "flightctl-observability-0:1.2.1-1.el9.ppc64le",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-observability-0:1.2.1-1.el9.s390x as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x"
        },
        "product_reference": "flightctl-observability-0:1.2.1-1.el9.s390x",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-observability-0:1.2.1-1.el9.x86_64 as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64"
        },
        "product_reference": "flightctl-observability-0:1.2.1-1.el9.x86_64",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-selinux-0:1.2.1-1.el9.noarch as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch"
        },
        "product_reference": "flightctl-selinux-0:1.2.1-1.el9.noarch",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-services-0:1.2.1-1.el9.aarch64 as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64"
        },
        "product_reference": "flightctl-services-0:1.2.1-1.el9.aarch64",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-services-0:1.2.1-1.el9.ppc64le as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le"
        },
        "product_reference": "flightctl-services-0:1.2.1-1.el9.ppc64le",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-services-0:1.2.1-1.el9.s390x as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x"
        },
        "product_reference": "flightctl-services-0:1.2.1-1.el9.s390x",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flightctl-services-0:1.2.1-1.el9.x86_64 as a component of RHEM 1.2 for RHEL 9",
          "product_id": "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
        },
        "product_reference": "flightctl-services-0:1.2.1-1.el9.x86_64",
        "relates_to_product_reference": "9Base-RHEM-1.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27145",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-06-02T23:01:08.992540+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484207"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
        ],
        "known_not_affected": [
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484207",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27145",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/783621",
          "url": "https://go.dev/cl/783621"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79694",
          "url": "https://go.dev/issue/79694"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5037",
          "url": "https://pkg.go.dev/vuln/GO-2026-5037"
        }
      ],
      "release_date": "2026-06-02T22:01:36.954000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T18:05:10+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge\nManager and more:\nhttps://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68335"
        },
        {
          "category": "workaround",
          "details": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "cve": "CVE-2026-33818",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:12:37.151735+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
        ],
        "known_not_affected": [
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/814980",
          "url": "https://go.dev/cl/814980"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80405",
          "url": "https://go.dev/issue/80405"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5972",
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "release_date": "2026-08-13T21:58:52.821000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T18:05:10+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge\nManager and more:\nhttps://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68335"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "cve": "CVE-2026-41178",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-04T16:01:10.300537+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484830"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in OpenTelemetry-Go, affecting versions 1.41.0 and 1.43.0. An attacker can exploit this flaw by sending oversized baggage headers, causing the `Parse` function to process invalid inputs and log errors, which can lead to resource exhaustion and service disruption in Red Hat products utilizing these affected OpenTelemetry-Go versions. The impact is considered Important due to the potential for remote, unauthenticated denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
        ],
        "known_not_affected": [
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484830",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484830"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41178",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41178",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "https://github.com/open-telemetry/opentelemetry-go/pull/7880",
          "url": "https://github.com/open-telemetry/opentelemetry-go/pull/7880"
        },
        {
          "category": "external",
          "summary": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835",
          "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
        }
      ],
      "release_date": "2026-06-04T14:38:23.707000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T18:05:10+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge\nManager and more:\nhttps://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68335"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers"
    },
    {
      "cve": "CVE-2026-44740",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-06-01T17:01:53.685793+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2483894"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation and missing safety mechanisms when processing untrusted repository data and filesystem structures, leading to panics, infinite loops, uncontrolled recursion, or excessive resource consumption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is rated as an Important severity issue. The `go-billy` library, a Go filesystem abstraction, is vulnerable to a denial of service when processing crafted or malformed input, such as untrusted repository data or filesystem structures. Insufficient validation and missing safety mechanisms can lead to panics, infinite loops, or excessive resource consumption, potentially impacting the availability of applications that rely on this library.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
        ],
        "known_not_affected": [
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44740"
        },
        {
          "category": "external",
          "summary": "RHBZ#2483894",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483894"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44740",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44740"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44740",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44740"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-billy/releases/tag/v5.9.0",
          "url": "https://github.com/go-git/go-billy/releases/tag/v5.9.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1",
          "url": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6",
          "url": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6"
        }
      ],
      "release_date": "2026-06-01T16:04:50.358000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T18:05:10+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge\nManager and more:\nhttps://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68335"
        },
        {
          "category": "workaround",
          "details": "To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation"
    },
    {
      "cve": "CVE-2026-48050",
      "discovery_date": "2026-08-21T22:51:05.227994+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Arc. This vulnerability allows a remote unauthenticated attacker to access Go debug pprof endpoints due to improper authentication bypass. Successful exploitation can lead to the disclosure of sensitive runtime state information and enable a CPU-burn Denial of Service (DoS) attack, impacting the availability and confidentiality of the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has determined that this flaw does not affect any currently supported Red Hat products. The vulnerability resides in the Arc component (github.com/basekick-labs/arc), which is not shipped in, bundled with, or included as a dependency of any Red Hat offering. Because the affected code is not present in Red Hat products, they are not vulnerable to this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
        ],
        "known_not_affected": [
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48050"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48050"
        }
      ],
      "release_date": "2026-08-21T22:40:12.771000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T18:05:10+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge\nManager and more:\nhttps://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68335"
        },
        {
          "category": "workaround",
          "details": "No mitigation is required. Red Hat products do not ship or include the affected Arc component (github.com/basekick-labs/arc), so they are not exposed to this vulnerability.",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http/pprof: github.com/basekick-labs/arc: Arc: Information disclosure and Denial of Service via unauthenticated debug endpoints"
    },
    {
      "cve": "CVE-2026-56852",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-21T20:01:56.266823+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504233"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
        ],
        "known_not_affected": [
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504233",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/794100",
          "url": "https://go.dev/cl/794100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80142",
          "url": "https://go.dev/issue/80142"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5970",
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "release_date": "2026-07-21T19:18:59.951000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T18:05:10+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge\nManager and more:\nhttps://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68335"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "cve": "CVE-2026-56853",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:14:53.561638+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: Unencrypted HTTP/2 servers are susceptible to a denial of service due to improper handling of ReadHeaderTimeout during the client preface reading phase. This can lead to resource exhaustion and service unavailability in affected Red Hat products configured to support unencrypted HTTP/2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
        ],
        "known_not_affected": [
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56853",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/795540",
          "url": "https://go.dev/cl/795540"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80205",
          "url": "https://go.dev/issue/80205"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6089",
          "url": "https://pkg.go.dev/vuln/GO-2026-6089"
        }
      ],
      "release_date": "2026-08-13T21:58:53.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T18:05:10+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge\nManager and more:\nhttps://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68335"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "cve": "CVE-2026-56858",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:32.034590+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515838"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash (\u0027/\u0027), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user\u0027s browser, potentially compromising user data or actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important cross-site scripting (XSS) vulnerability in the Go `html/template` package. Applications utilizing this package to render untrusted input are susceptible to arbitrary content injection due to a flaw in how pathological inputs are handled, potentially leading to client-side script execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
        ],
        "known_not_affected": [
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515838",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/807100",
          "url": "https://go.dev/cl/807100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80435",
          "url": "https://go.dev/issue/80435"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6091",
          "url": "https://pkg.go.dev/vuln/GO-2026-6091"
        }
      ],
      "release_date": "2026-08-13T21:58:53.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T18:05:10+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge\nManager and more:\nhttps://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68335"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "cve": "CVE-2026-56859",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:52.493058+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515840"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important denial of service flaw affects applications utilizing the Go `encoding/xml` package. This vulnerability arises from an issue in XML decoding where a recursion depth counter fails to reset, potentially leading to stack exhaustion when processing malicious XML input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
        ],
        "known_not_affected": [
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515840",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56859",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803320",
          "url": "https://go.dev/cl/803320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80481",
          "url": "https://go.dev/issue/80481"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6088",
          "url": "https://pkg.go.dev/vuln/GO-2026-6088"
        }
      ],
      "release_date": "2026-08-13T21:58:52.959000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T18:05:10+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge\nManager and more:\nhttps://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68335"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "cve": "CVE-2026-56860",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:13:18.319384+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory (\u0027..\u0027) segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments (\u0027..\u0027) may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
        ],
        "known_not_affected": [
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803681",
          "url": "https://go.dev/cl/803681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80494",
          "url": "https://go.dev/issue/80494"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6218",
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "release_date": "2026-08-13T21:58:53.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T18:05:10+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge\nManager and more:\nhttps://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68335"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "cve": "CVE-2026-56862",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-08-13T22:16:41.928450+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515839"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `golang` `crypto/tls` package. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
        ],
        "known_not_affected": [
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515839",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/804261",
          "url": "https://go.dev/cl/804261"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80528",
          "url": "https://go.dev/issue/80528"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6090",
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "release_date": "2026-08-13T21:58:53.216000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T18:05:10+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge\nManager and more:\nhttps://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68335"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "cve": "CVE-2026-71556",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2026-08-07T16:51:14.251077+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2512562"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink, which, when cloned and its worktree operations are used, can lead to reading from or writing to arbitrary files outside the intended working directory. This could result in information disclosure or arbitrary file modification.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "go-git is a pure-Go implementation of Git. During worktree operations (checkout, status, add), go-git resolves symbolic links without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause a consuming application to read from or write to files outside the intended working directory when that repository is cloned and its worktree operations are used. Exploitation requires the application to clone an attacker-controlled repository and then perform worktree operations against it; applications that only process trusted repositories are not exposed. Red Hat rates the impact of this flaw as Important.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
        ],
        "known_not_affected": [
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
          "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
          "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
          "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
          "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-71556"
        },
        {
          "category": "external",
          "summary": "RHBZ#2512562",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512562"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-71556",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-71556"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71556",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71556"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab",
          "url": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac",
          "url": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/releases/tag/v5.19.2",
          "url": "https://github.com/go-git/go-git/releases/tag/v5.19.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5",
          "url": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm",
          "url": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm"
        }
      ],
      "release_date": "2026-08-07T16:37:40.058000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T18:05:10+00:00",
          "details": "See the following documentation for details on how to enable Red Hat Edge\nManager and more:\nhttps://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68335"
        },
        {
          "category": "workaround",
          "details": "To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later).",
          "product_ids": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "10Base-RHEM-1.2:flightctl-0:1.2.1-1.el10.src",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el10.x86_64",
            "10Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el10.noarch",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.aarch64",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.ppc64le",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.s390x",
            "10Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el10.x86_64",
            "9Base-RHEM-1.2:flightctl-0:1.2.1-1.el9.src",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-agent-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-cli-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-observability-0:1.2.1-1.el9.x86_64",
            "9Base-RHEM-1.2:flightctl-selinux-0:1.2.1-1.el9.noarch",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.aarch64",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.ppc64le",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.s390x",
            "9Base-RHEM-1.2:flightctl-services-0:1.2.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution"
    }
  ]
}

CVE-2026-27145 (GCVE-0-2026-27145)

Vulnerability from cvelistv5 – Published: 2026-06-02 22:01 – Updated: 2026-09-16 12:04

Title

Inefficient candidate hostname parsing in crypto/x509

Summary

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-04 12:34 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity
CWE-606 - Unchecked Input for Loop Condition

Assigner

Go Google root

References

98 references

URL	Tags
https://go.dev/cl/783621
https://go.dev/issue/79694
https://groups.google.com/g/golang-announce/c/tKs…
https://pkg.go.dev/vuln/GO-2026-5037
https://access.redhat.com/security/cve/CVE-2026-27145	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2484207	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:42079	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42080	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53416	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:50319	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54757	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57482	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42082	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42150	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42151	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42240	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49703	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49702	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53413	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53374	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54168	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51187	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:46394	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:46395	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29980	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35832	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34357	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39005	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42946	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39573	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38995	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41930	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61253	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60354	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57649	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53412	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60315	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49712	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53415	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54401	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29981	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34359	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39879	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36317	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54531	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61314	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54500	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41030	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44622	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47149	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53530	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:52946	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66022	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51057	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60387	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47737	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60390	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60388	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54427	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60391	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60386	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:63016	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42142	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33574	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23262	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23264	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54441	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42644	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36648	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41036	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60025	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57488	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54603	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49705	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49729	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49744	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49765	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49770	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:50205	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36797	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42043	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42047	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42050	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42051	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42049	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55899	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54435	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54525	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57194	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59556	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59593	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59557	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54432	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59579	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59558	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47735	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59559	vendor-advisoryx_refsource_REDHAT

Impacted products

229 products

Vendor	Product	Version
Go standard library	crypto/x509	Affected: 0 , < 1.25.11 (semver) Affected: 1.26.0-0 , < 1.26.4 (semver)
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	Unaffected: 0:1.6.7-1.el8ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.5::el8
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 9	Unaffected: 0:1.6.7-1.el9ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.5::el9
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 10	Unaffected: 0:1.6.6-1.el10ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.6::el10
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9	Unaffected: 0:1.6.6-1.el9ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.6::el9
Red Hat	Red Hat Ansible Automation Platform 2.7 for RHEL 10	Unaffected: 0:1.6.6-1.el10ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.7::el10
Red Hat	Red Hat Ansible Automation Platform 2.7 for RHEL 9	Unaffected: 0:1.6.6-1.el9ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.7::el9
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:1.26.4-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.152.1-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.9.27-7.el10_2.2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:0.3.8-6.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.4.9.2-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.2.10-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:1.0.0-4.el10_2.5 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:1.0.1-2.el10_2.3 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:1.26.5-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:1.26.1-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:0.4.7-5.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 1:0.3.2-5.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:0.152.1-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:0.2.3-6.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.4.0-8.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260710105056.a3795dee , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 1:0.2.5-9.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.26.4-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.152.1-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.22.2-7.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 1:0.2.7-8.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 1:0.2.2-1.el9_2.4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:1.26.5-1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:0.152.1-1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:1.26.5-1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 1:0.2.4-9.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:1.26.5-1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:0.152.1-1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 1:0.2.7-1.el9_6.5 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 0:0.23.0-5.rhaos4.18.el8 , < * (rpm) cpe:/a:redhat:openshift:4.18::el8
Red Hat	Red Hat OpenStack Platform 16.2	Unaffected: 0:0.2.1-1.1.el8ost , < * (rpm) cpe:/a:redhat:openstack:16.2::el8
Red Hat	Red Hat Satellite 6.16 for RHEL 8	Unaffected: 0:0.0.4-1.el8sat , < * (rpm) cpe:/a:redhat:satellite:6.16::el8
Red Hat	Red Hat Satellite 6.16 for RHEL 9	Unaffected: 0:0.0.4-1.el9sat , < * (rpm) cpe:/a:redhat:satellite:6.16::el9
Red Hat	Red Hat Satellite 6.17 for RHEL 9	Unaffected: 0:0.0.4-1.el9sat , < * (rpm) cpe:/a:redhat:satellite:6.17::el9
Red Hat	Red Hat Satellite 6.18 for RHEL 9	Unaffected: 0:0.0.4-1.el9sat , < * (rpm) cpe:/a:redhat:satellite:6.18::el9
Red Hat	Red Hat Satellite 6.19 for RHEL 9	Unaffected: 0:0.0.4-1.el9sat , < * (rpm) cpe:/a:redhat:satellite:6.19::el9
Red Hat	Streams for Apache Kafka 3.2.1	Unaffected: danielqsj-kafka_exporter , < * (rpm) cpe:/a:redhat:amq_streams:3.2::el9
Red Hat	Cert Manager support for Red Hat OpenShift release 1.19	Unaffected: 1786613805 , < * (rpm) cpe:/a:redhat:cert_manager:1.19::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1787593946 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Compliance Operator 1	Unaffected: 1786380082 , < * (rpm) cpe:/a:redhat:openshift_compliance_operator:1::el9
Red Hat	external secrets operator for Red Hat OpenShift 1.1	Unaffected: 1786614676 , < * (rpm) cpe:/a:redhat:external_secrets_operator:1.1::el9
Red Hat	multicluster engine for Kubernetes 2.1	Unaffected: 1786549223 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.10::el9
Red Hat	multicluster engine for Kubernetes 2.1	Unaffected: 1787201612 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.10::el9
Red Hat	multicluster engine for Kubernetes 2.1	Unaffected: 1786764622 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.10::el9
Red Hat	multicluster engine for Kubernetes 2.1	Unaffected: 1787176886 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.10::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786911941 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786911952 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786911945 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786912006 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786911973 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786911950 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786911984 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786907276 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1787238383 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1787239116 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1787239595 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.17	Unaffected: 1786577950 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.17::el9
Red Hat	multicluster engine for Kubernetes 2.17	Unaffected: 1786750700 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.17::el9
Red Hat	multicluster engine for Kubernetes 2.17	Unaffected: 1786983362 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.17::el9
Red Hat	multicluster engine for Kubernetes 2.17	Unaffected: 1786664288 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.17::el9
Red Hat	multicluster engine for Kubernetes 2.6	Unaffected: 1787259112 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.6::el9
Red Hat	multicluster engine for Kubernetes 2.6	Unaffected: 1787264185 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.6::el9
Red Hat	multicluster engine for Kubernetes 2.6	Unaffected: 1787259740 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.6::el9
Red Hat	multicluster engine for Kubernetes 2.6	Unaffected: 1787260821 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.6::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1784737366 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1784738758 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1784677239 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259015 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259059 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259011 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259016 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787258993 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259044 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259047 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259108 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259099 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259126 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259114 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259113 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.9	Unaffected: 1787195995 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.9::el9
Red Hat	multicluster engine for Kubernetes 2.9	Unaffected: 1787201646 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.9::el9
Red Hat	multicluster engine for Kubernetes 2.9	Unaffected: 1786764601 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.9::el9
Red Hat	multicluster engine for Kubernetes 2.9	Unaffected: 1787176716 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.9::el9
Red Hat	Multicluster Global Hub 1.4.5	Unaffected: 1784061472 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.4::el9
Red Hat	Multicluster Global Hub 1.6.5	Unaffected: 1784152046 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.6::el9
Red Hat	Multicluster Global Hub 1.7.0	Unaffected: 1784768332 , < * (rpm) Unaffected: 1785775948 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.7::el9
Red Hat	Multicluster Global Hub 1.8.0	Unaffected: 1785763319 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.8::el9
Red Hat	OpenShift API for Data Protection 1.5	Unaffected: 1788860461 , < * (rpm) cpe:/a:redhat:openshift_api_data_protection:1.5::el9
Red Hat	OpenShift Developer Tools and Services 1.6.3	Unaffected: 1784727697 , < * (rpm) cpe:/a:redhat:source_to_image:1.6::el8
Red Hat	OpenShift Developer Tools and Services 1.6.3	Unaffected: 1784728036 , < * (rpm) cpe:/a:redhat:source_to_image:1.6::el8
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.11	Unaffected: 1787260689 , < * (rpm) cpe:/a:redhat:acm:2.11::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.11	Unaffected: 1787262214 , < * (rpm) cpe:/a:redhat:acm:2.11::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.11	Unaffected: 1787260663 , < * (rpm) cpe:/a:redhat:acm:2.11::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.11	Unaffected: 1787263584 , < * (rpm) cpe:/a:redhat:acm:2.11::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	Unaffected: 1784677172 , < * (rpm) cpe:/a:redhat:acm:2.13::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	Unaffected: 1784638644 , < * (rpm) cpe:/a:redhat:acm:2.13::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	Unaffected: 1784590741 , < * (rpm) cpe:/a:redhat:acm:2.13::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	Unaffected: 1787259106 , < * (rpm) cpe:/a:redhat:acm:2.13::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	Unaffected: 1787259284 , < * (rpm) cpe:/a:redhat:acm:2.13::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	Unaffected: 1787259310 , < * (rpm) cpe:/a:redhat:acm:2.13::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	Unaffected: 1787263693 , < * (rpm) cpe:/a:redhat:acm:2.13::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.14	Unaffected: 1787183407 , < * (rpm) cpe:/a:redhat:acm:2.14::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.14	Unaffected: 1786976940 , < * (rpm) cpe:/a:redhat:acm:2.14::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.14	Unaffected: 1787172840 , < * (rpm) cpe:/a:redhat:acm:2.14::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.14	Unaffected: 1787170830 , < * (rpm) cpe:/a:redhat:acm:2.14::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.15	Unaffected: 1786547792 , < * (rpm) cpe:/a:redhat:acm:2.15::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.15	Unaffected: 1786547807 , < * (rpm) cpe:/a:redhat:acm:2.15::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.15	Unaffected: 1786549537 , < * (rpm) cpe:/a:redhat:acm:2.15::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	Unaffected: 1787252179 , < * (rpm) cpe:/a:redhat:acm:2.16::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	Unaffected: 1787242135 , < * (rpm) cpe:/a:redhat:acm:2.16::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	Unaffected: 1787242105 , < * (rpm) cpe:/a:redhat:acm:2.16::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	Unaffected: 1787242321 , < * (rpm) cpe:/a:redhat:acm:2.16::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	Unaffected: 1787243221 , < * (rpm) cpe:/a:redhat:acm:2.17::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	Unaffected: 1787242131 , < * (rpm) cpe:/a:redhat:acm:2.17::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	Unaffected: 1787242099 , < * (rpm) cpe:/a:redhat:acm:2.17::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	Unaffected: 1787242108 , < * (rpm) cpe:/a:redhat:acm:2.17::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	Unaffected: 1788105072 , < * (rpm) cpe:/a:redhat:acm:2.17::el9
Red Hat	Red Hat Ansible Automation Platform 2.7	Unaffected: 1783917963 , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.7::el9
Red Hat	Red Hat Developer Hub 1.9	Unaffected: 1782767215 , < * (rpm) cpe:/a:redhat:rhdh:1.9::el9
Red Hat	Red Hat Hardened Images	Unaffected: 1.25.11-2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 1.26.4-2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Lightspeed (formerly Insights) for Runtimes 1.0	Unaffected: 1786483782 , < * (rpm) cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9
Red Hat	Red Hat OpenShift AI 2.25	Unaffected: 1784004914 , < * (rpm) cpe:/a:redhat:openshift_ai:2.25::el9
Red Hat	Red Hat OpenShift Builds 1.7.3	Unaffected: 1783057868 , < * (rpm) cpe:/a:redhat:openshift_builds:1.7::el9
Red Hat	Red Hat OpenShift Builds 1.8.1	Unaffected: 1784121108 , < * (rpm) cpe:/a:redhat:openshift_builds:1.8::el9
Red Hat	Red Hat OpenShift Builds 1.8.1	Unaffected: 1783612119 , < * (rpm) cpe:/a:redhat:openshift_builds:1.8::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 1787554347 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 1786754425 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 1786526139 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift distributed tracing 3.10.2	Unaffected: 1785704636 , < * (rpm) cpe:/a:redhat:openshift_distributed_tracing:3.10::el9
Red Hat	Red Hat OpenShift distributed tracing 3.10.2	Unaffected: 1785704547 , < * (rpm) cpe:/a:redhat:openshift_distributed_tracing:3.10::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1784885742 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1784885559 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1784908682 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1784917979 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1784885281 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1784885133 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1784953556 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1784918113 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1784921753 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1784921772 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1784953743 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1784918117 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1784885810 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1784885681 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1784908639 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1785316150 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3.4	Unaffected: 1785131046 , < * (rpm) cpe:/a:redhat:service_mesh:3.4::el9
Red Hat	Red Hat OpenShift Service Mesh 3.4	Unaffected: 1785131063 , < * (rpm) cpe:/a:redhat:service_mesh:3.4::el9
Red Hat	Red Hat OpenShift Service Mesh 3.4	Unaffected: 1785131291 , < * (rpm) cpe:/a:redhat:service_mesh:3.4::el9
Red Hat	Red Hat OpenShift Service Mesh 3.4	Unaffected: 1785317214 , < * (rpm) cpe:/a:redhat:service_mesh:3.4::el9
Red Hat	Red Hat Trusted Artifact Signer 1.4	Unaffected: 4-1.4.2 , < * (rpm) Unaffected: 4-1.4.3 , < * (rpm) cpe:/a:redhat:trusted_artifact_signer:1.4::el9
Red Hat	Red Hat Web Terminal 1.11	Unaffected: 1784296203 , < * (rpm) cpe:/a:redhat:webterminal:1.11::el9
Red Hat	Red Hat Web Terminal 1.12	Unaffected: 1784247610 , < * (rpm) cpe:/a:redhat:webterminal:1.12::el9
Red Hat	Red Hat Web Terminal 1.13	Unaffected: 1784296127 , < * (rpm) cpe:/a:redhat:webterminal:1.13::el9
Red Hat	Red Hat Web Terminal 1.14	Unaffected: 1784296114 , < * (rpm) cpe:/a:redhat:webterminal:1.14::el9
Red Hat	Red Hat Web Terminal 1.15	Unaffected: 1784296033 , < * (rpm) cpe:/a:redhat:webterminal:1.15::el9
Red Hat	Red Hat Web Terminal 1.16	Unaffected: 1786654871 , < * (rpm) cpe:/a:redhat:webterminal:1.16::el9
Red Hat	Assisted Installer for Red Hat OpenShift Container Platform 2	cpe:/a:redhat:assisted_installer:2
Red Hat	Confidential Compute Attestation	cpe:/a:redhat:confidential_compute_attestation:1
Red Hat	Cryostat 4	cpe:/a:redhat:cryostat:4
Red Hat	Custom Metric Autoscaler operator for Red Hat Openshift	cpe:/a:redhat:openshift_custom_metrics_autoscaler:2
Red Hat	Deployment Validation Operator	cpe:/a:redhat:deployment_validator_operator
Red Hat	ExternalDNS Operator	cpe:/a:redhat:ext_dns_optr:1
Red Hat	Fence Agents Remediation Operator	cpe:/a:redhat:workload_availability_far:0
Red Hat	File Integrity Operator	cpe:/a:redhat:openshift_file_integrity_operator:1
Red Hat	Gatekeeper 3	cpe:/a:redhat:gatekeeper:3
Red Hat	Logging Subsystem for Red Hat OpenShift	cpe:/a:redhat:logging:6
Red Hat	Logical Volume Manager Storage	cpe:/a:redhat:lvms:4
Red Hat	Machine Deletion Remediation Operator	cpe:/a:redhat:workload_availability_mdr:0
Red Hat	Migration Toolkit for Applications 8	cpe:/a:redhat:migration_toolkit_applications:8
Red Hat	Migration Toolkit for Containers	cpe:/a:redhat:rhmt:1
Red Hat	mirror registry for Red Hat OpenShift 2	cpe:/a:redhat:mirror_registry:2
Red Hat	Multiarch Tuning Operator	cpe:/a:redhat:multiarch_tuning_operator
Red Hat	Multicluster Engine for Kubernetes	cpe:/a:redhat:multicluster_engine
Red Hat	Network Observability Operator	cpe:/a:redhat:network_observ_optr:1
Red Hat	Node HealthCheck Operator	cpe:/a:redhat:workload_availability_nhc:0
Red Hat	OpenShift Developer Tools and Services	cpe:/a:redhat:ocp_tools
Red Hat	OpenShift Lightspeed	cpe:/a:redhat:openshift_lightspeed
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	OpenShift Serverless	cpe:/a:redhat:serverless:1
Red Hat	OpenShift Service Mesh 2	cpe:/a:redhat:service_mesh:2
Red Hat	OpenShift Service Mesh 3	cpe:/a:redhat:service_mesh:3
Red Hat	Power monitoring for Red Hat OpenShift	cpe:/a:redhat:openshift_power_monitoring
Red Hat	Red Hat 3scale API Management Platform 2	cpe:/a:redhat:red_hat_3scale_amp:2
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	cpe:/a:redhat:acm:2
Red Hat	Red Hat Advanced Cluster Security 4	cpe:/a:redhat:advanced_cluster_security:4
Red Hat	Red Hat Ansible Automation Platform 2	cpe:/a:redhat:ansible_automation_platform:2
Red Hat	Red Hat Ceph Storage 5	cpe:/a:redhat:ceph_storage:5
Red Hat	Red Hat Ceph Storage 6	cpe:/a:redhat:ceph_storage:6
Red Hat	Red Hat Ceph Storage 7	cpe:/a:redhat:ceph_storage:7
Red Hat	Red Hat Ceph Storage 8	cpe:/a:redhat:ceph_storage:8
Red Hat	Red Hat Ceph Storage 9	cpe:/a:redhat:ceph_storage:9
Red Hat	Red Hat Connectivity Link 1	cpe:/a:redhat:connectivity_link:1
Red Hat	Red Hat Edge Manager 1	cpe:/a:redhat:edge_manager:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	cpe:/a:redhat:enterprise_linux_ai:3
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift Cluster Manager CLI	cpe:/a:redhat:openshift_cluster_manager_cli:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat Openshift Data Foundation 4	cpe:/a:redhat:openshift_data_foundation:4
Red Hat	Red Hat OpenShift Dev Spaces	cpe:/a:redhat:openshift_devspaces:3
Red Hat	Red Hat OpenShift Dev Workspaces Operator	cpe:/a:redhat:devworkspace
Red Hat	Red Hat OpenShift distributed tracing 3	cpe:/a:redhat:openshift_distributed_tracing:3
Red Hat	Red Hat OpenShift for Windows Containers	cpe:/a:redhat:windows_machine_config
Red Hat	Red Hat OpenShift GitOps	cpe:/a:redhat:openshift_gitops:1
Red Hat	Red Hat OpenShift on AWS	cpe:/a:redhat:openshift_service_on_aws:1
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenStack Platform 16.2	cpe:/a:redhat:openstack:16.2
Red Hat	Red Hat OpenStack Platform 17.1	cpe:/a:redhat:openstack:17.1
Red Hat	Red Hat OpenStack Platform 18.0	cpe:/a:redhat:openstack:18.0
Red Hat	Red Hat Quay 3	cpe:/a:redhat:quay:3
Red Hat	Red Hat Satellite 6	cpe:/a:redhat:satellite:6
Red Hat	Red Hat Service Interconnect 2	cpe:/a:redhat:service_interconnect:2
Red Hat	Security Profiles Operator	cpe:/a:redhat:openshift_security_profiles_operator:1
Red Hat	Service Telemetry Framework 1.5	cpe:/a:redhat:stf:1.5
Red Hat	streams for Apache Kafka 2	cpe:/a:redhat:amq_streams:2
Red Hat	Zero Trust Workload Identity Manager	cpe:/a:redhat:zero_trust_workload_identity_manager:1
Red Hat	Zero Trust Workload Identity Manager - Tech Preview	cpe:/a:redhat:zero_trust_workload_identity_manager:0

Credits

Jakub Ciolek - https://ciolek.dev/

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-27145",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T12:34:03.859208Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-04T12:34:53.136Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.5::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "receptor",
            "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.6.7-1.el8ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "receptor",
            "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.6.7-1.el9ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.6::el10"
            ],
            "defaultStatus": "affected",
            "packageName": "receptor",
            "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.6.6-1.el10ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "receptor",
            "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.6.6-1.el9ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.7::el10"
            ],
            "defaultStatus": "affected",
            "packageName": "receptor",
            "product": "Red Hat Ansible Automation Platform 2.7 for RHEL 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.6.6-1.el10ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.7::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "receptor",
            "product": "Red Hat Ansible Automation Platform 2.7 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.6.6-1.el9ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.4-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.152.1-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang-github-openprinting-ipp-usb",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.9.27-7.el10_2.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:0.3.8-6.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "yggdrasil",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.4.9.2-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc-worker-playbook",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.2.10-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "go-fdo-client",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.0.0-4.el10_2.5",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "go-fdo-server",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.0.1-2.el10_2.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "delve",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.1-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "yggdrasil",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.4.7-5.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:0.3.2-5.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.152.1-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc-worker-playbook",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.2.3-6.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "host-metering",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.4.0-8.el7_9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "go-toolset:rhel8",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260710105056.a3795dee",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:0.2.5-9.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.4-1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.152.1-1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "skopeo",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "2:1.22.2-7.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:0.2.7-8.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:0.2.2-1.el9_2.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.152.1-1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:0.2.4-9.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.152.1-1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:0.2.7-1.el9_6.5",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "butane",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.23.0-5.rhaos4.18.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "collectd-sensubility",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.2.1-1.1.el8ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6.16::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "yggdrasil-worker-forwarder",
            "product": "Red Hat Satellite 6.16 for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.0.4-1.el8sat",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "yggdrasil-worker-forwarder",
            "product": "Red Hat Satellite 6.16 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.0.4-1.el9sat",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "yggdrasil-worker-forwarder",
            "product": "Red Hat Satellite 6.17 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.0.4-1.el9sat",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "yggdrasil-worker-forwarder",
            "product": "Red Hat Satellite 6.18 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.0.4-1.el9sat",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "yggdrasil-worker-forwarder",
            "product": "Red Hat Satellite 6.19 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.0.4-1.el9sat",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "golang-github",
            "product": "Streams for Apache Kafka 3.2.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "danielqsj-kafka_exporter",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cert_manager:1.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cert-manager/jetstack-cert-manager-rhel9",
            "product": "Cert Manager support for Red Hat OpenShift release 1.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786613805",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/perses-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787593946",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_compliance_operator:1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "compliance/openshift-compliance-operator-bundle",
            "product": "Compliance Operator 1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786380082",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:external_secrets_operator:1.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "external-secrets-operator/external-secrets-rhel9",
            "product": "external secrets operator for Red Hat OpenShift 1.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786614676",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786549223",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-curator-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787201612",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-image-set-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786764622",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/provider-credential-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787176886",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/addon-manager-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911941",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/backplane-rhel9-operator",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911952",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/clusterlifecycle-state-metrics-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911945",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/hypershift-addon-rhel9-operator",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786912006",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/managedcluster-import-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911973",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/multicloud-manager-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911950",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/placement-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911984",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/registration-operator-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911984",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/work-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786907276",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-curator-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787238383",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-image-set-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787239116",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/provider-credential-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787239595",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786577950",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-curator-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786750700",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-image-set-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786983362",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/provider-credential-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786664288",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259112",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-curator-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787264185",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-image-set-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259740",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/provider-credential-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787260821",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/backplane-rhel9-operator",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784737366",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/hypershift-addon-rhel9-operator",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784738758",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/kube-rbac-proxy-mce-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784677239",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/addon-manager-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259015",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259059",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-curator-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259011",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-image-set-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259016",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/clusterlifecycle-state-metrics-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787258993",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/managedcluster-import-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259044",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/multicloud-manager-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259047",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/placement-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259108",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/provider-credential-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259099",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/registration-operator-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259126",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/registration-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259114",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/work-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259113",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787195995",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-curator-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787201646",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-image-set-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786764601",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/provider-credential-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787176716",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
            "product": "Multicluster Global Hub 1.4.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784061472",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
            "product": "Multicluster Global Hub 1.6.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784152046",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.7::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
            "product": "Multicluster Global Hub 1.7.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784768332",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785775948",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
            "product": "Multicluster Global Hub 1.8.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785763319",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "oadp/oadp-velero-rhel9",
            "product": "OpenShift API for Data Protection 1.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1788860461",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:source_to_image:1.6::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "source-to-image/source-to-image-rhel8",
            "product": "OpenShift Developer Tools and Services 1.6.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784727697",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:source_to_image:1.6::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "source-to-image/source-to-image-rhel9",
            "product": "OpenShift Developer Tools and Services 1.6.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784728036",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicloud-integrations-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787260689",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-application-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787262214",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-channel-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787260663",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787263584",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/kube-rbac-proxy-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784677172",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multiclusterhub-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784638644",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-observability-rhel9-operator",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784590741",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicloud-integrations-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259106",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-application-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259284",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-channel-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787259310",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787263693",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicloud-integrations-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787183407",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-application-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786976940",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-channel-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787172840",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787170830",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-application-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786547792",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-channel-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786547807",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786549537",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicloud-integrations-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787252179",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-application-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787242135",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-channel-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787242105",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787242321",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicloud-integrations-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787243221",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-application-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787242131",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-channel-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787242099",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787242108",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/subctl-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1788105072",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.7::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform-27/receptor-rhel9",
            "product": "Red Hat Ansible Automation Platform 2.7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783917963",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-rhel9-operator",
            "product": "Red Hat Developer Hub 1.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782767215",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "golang1-25-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.25.11-2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "golang1-26-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.26.4-2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator",
            "product": "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786483782",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-rhel9-operator",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784004914",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_builds:1.7::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-builds/openshift-builds-waiters-rhel9",
            "product": "Red Hat OpenShift Builds 1.7.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783057868",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_builds:1.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-builds/openshift-builds-rhel9-operator",
            "product": "Red Hat OpenShift Builds 1.8.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784121108",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_builds:1.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-builds/openshift-builds-waiters-rhel9",
            "product": "Red Hat OpenShift Builds 1.8.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783612119",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-ansible-rhel9-operator",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787554347",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-ansible-rhel9-operator",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786754425",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-ansible-rhel9-operator",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786526139",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_distributed_tracing:3.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosdt/opentelemetry-collector-rhel9",
            "product": "Red Hat OpenShift distributed tracing 3.10.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785704636",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_distributed_tracing:3.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosdt/opentelemetry-rhel9-operator",
            "product": "Red Hat OpenShift distributed tracing 3.10.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785704547",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784885742",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784885559",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784908682",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784917979",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784885281",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784885133",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784953556",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784918113",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784921753",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784921772",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784953743",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784918117",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784885810",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784885681",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784908639",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785316150",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785131046",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785131063",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785131291",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785317214",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "conforma-cli-stack-v1",
            "product": "Red Hat Trusted Artifact Signer 1.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4-1.4.2",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4-1.4.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784296203",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.12::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784247610",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784296127",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784296114",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784296033",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:webterminal:1.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "web-terminal/web-terminal-exec-rhel9",
            "product": "Red Hat Web Terminal 1.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786654871",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:assisted_installer:2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhai/assisted-installer-rhel9",
            "product": "Assisted Installer for Red Hat OpenShift Container Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:confidential_compute_attestation:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "build-of-trustee/trustee-rhel9-operator",
            "product": "Confidential Compute Attestation",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:confidential_compute_attestation:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-sandboxed-containers/osc-monitor-rhel9",
            "product": "Confidential Compute Attestation",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "cryostat/cryostat-storage-rhel9",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9",
            "product": "Custom Metric Autoscaler operator for Red Hat Openshift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:deployment_validator_operator"
            ],
            "defaultStatus": "affected",
            "packageName": "dvo/deployment-validation-rhel8-operator",
            "product": "Deployment Validation Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ext_dns_optr:1"
            ],
            "defaultStatus": "affected",
            "packageName": "edo/external-dns-rhel9",
            "product": "ExternalDNS Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ext_dns_optr:1"
            ],
            "defaultStatus": "affected",
            "packageName": "edo/external-dns-rhel9-operator",
            "product": "ExternalDNS Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_far:0"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/fence-agents-remediation-rhel8-operator",
            "product": "Fence Agents Remediation Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_file_integrity_operator:1"
            ],
            "defaultStatus": "affected",
            "packageName": "compliance/openshift-compliance-operator-bundle",
            "product": "File Integrity Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:gatekeeper:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "gatekeeper/gatekeeper-rhel9-operator",
            "product": "Gatekeeper 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:logging:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-logging/eventrouter-rhel9",
            "product": "Logging Subsystem for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lvms:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "lvms4/lvms-rhel9-operator",
            "product": "Logical Volume Manager Storage",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lvms:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "lvms4/topolvm-rhel8",
            "product": "Logical Volume Manager Storage",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lvms:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "lvms4/topolvm-rhel9",
            "product": "Logical Volume Manager Storage",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_mdr:0"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/machine-deletion-remediation-rhel8-operator",
            "product": "Machine Deletion Remediation Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:migration_toolkit_applications:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "mta/mta-cli-rhel9",
            "product": "Migration Toolkit for Applications 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhmt:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhmtc/openshift-migration-registry-rhel8",
            "product": "Migration Toolkit for Containers",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:mirror_registry:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift/mirror-registry-rhel8",
            "product": "mirror registry for Red Hat OpenShift 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multiarch_tuning_operator"
            ],
            "defaultStatus": "affected",
            "packageName": "multiarch-tuning/multiarch-tuning-rhel9-operator",
            "product": "Multiarch Tuning Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/assisted-service-9-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "unaffected",
            "packageName": "multicluster-engine/discovery-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/hive-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/maestro-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:network_observ_optr:1"
            ],
            "defaultStatus": "affected",
            "packageName": "network-observability/network-observability-cli-rhel9",
            "product": "Network Observability Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0"
            ],
            "defaultStatus": "affected",
            "packageName": "node-healthcheck-operator-tech-preview/node-healthcheck-operator-rhel8",
            "product": "Node HealthCheck Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0"
            ],
            "defaultStatus": "affected",
            "packageName": "node-healthcheck-operator-tech-preview/node-healthcheck-rhel8-operator",
            "product": "Node HealthCheck Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/node-healthcheck-rhel8-operator",
            "product": "Node HealthCheck Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools"
            ],
            "defaultStatus": "unaffected",
            "packageName": "helm",
            "product": "OpenShift Developer Tools and Services",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_lightspeed"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-lightspeed/lightspeed-rhel9-operator",
            "product": "OpenShift Lightspeed",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines-client",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-scheduler-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kn-workflow-plugin",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-serverless-1/kn-plugin-event-sender-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-serverless-1/logic-rhel9-operator",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-clients",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-service-mesh/kiali-rhel8",
            "product": "OpenShift Service Mesh 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rh-osbs/openshift-golang-builder",
            "product": "OpenShift Service Mesh 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-service-mesh/kiali-rhel9",
            "product": "OpenShift Service Mesh 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_power_monitoring"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-power-monitoring/kepler-rhel9",
            "product": "Power monitoring for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_3scale_amp:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "3scale-amp2/3scale-rhel7-operator",
            "product": "Red Hat 3scale API Management Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_3scale_amp:2"
            ],
            "defaultStatus": "affected",
            "packageName": "3scale-amp2/3scale-rhel9-operator",
            "product": "Red Hat 3scale API Management Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/acm-governance-policy-addon-controller-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/acm-governance-policy-framework-addon-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/acm-volsync-addon-controller-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/config-policy-controller-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/governance-policy-propagator-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/klusterlet-addon-controller-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/thanos-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "advanced-cluster-security/rhacs-main-rhel8",
            "product": "Red Hat Advanced Cluster Security 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "advanced-cluster-security/rhacs-main-rhel9",
            "product": "Red Hat Advanced Cluster Security 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ansible-automation-platform/platform-operator-bundle",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "automation-gateway-proxy",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "automation-gateway-proxy-openssl30",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "automation-gateway-proxy-openssl32",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python3.11-galaxy-ng",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python3.11-grpcio",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python3.12-galaxy-ng",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python3.12-grpcio",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python3x-grpcio",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python-grpcio",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:5"
            ],
            "defaultStatus": "affected",
            "packageName": "rhceph/snmp-notifier-rhel8",
            "product": "Red Hat Ceph Storage 5",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:6"
            ],
            "defaultStatus": "affected",
            "packageName": "rhceph/snmp-notifier-rhel9",
            "product": "Red Hat Ceph Storage 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhceph/grafana-rhel9",
            "product": "Red Hat Ceph Storage 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhceph/grafana-rhel9",
            "product": "Red Hat Ceph Storage 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhceph/alloy-rhel10",
            "product": "Red Hat Ceph Storage 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:connectivity_link:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcl-1/authorino-rhel9",
            "product": "Red Hat Connectivity Link 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:connectivity_link:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcl-1/coredns-rhel9",
            "product": "Red Hat Connectivity Link 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "flightctl",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhem/flightctl-ui-rhel9",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "buildah",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "butane",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "conmon",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "delve",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "git-lfs",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana-pcp",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "gvisor-tap-vsock",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ignition",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "image-builder",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "podman",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhel10/bootc-image-builder",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhel10-eus/rhel-10.0-bootc-image-builder",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "skopeo",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "toolbox",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "trustee",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "trustee-guest-components",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "rhc",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhc-worker-script",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/buildah",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/conmon",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/containernetworking-plugins",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/podman",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/runc",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/skopeo",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-tools:rhel8/toolbox",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "git-lfs",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana-pcp",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "weldr-client",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "buildah",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "butane",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "conmon",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "containernetworking-plugins",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "git-lfs",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana-pcp",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "gvisor-tap-vsock",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ignition",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "image-builder",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "podman",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhel9/bootc-image-builder",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhel9-eus/rhel-9.6-bootc-image-builder",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "runc",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "toolbox",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "trustee-guest-components",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "weldr-client",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-rhel8-operator",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/rhai-cli-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_cluster_manager_cli:1"
            ],
            "defaultStatus": "affected",
            "packageName": "ocm-cli-clients/ocm-cli-rhel9",
            "product": "Red Hat OpenShift Cluster Manager CLI",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "conmon",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "conmon-rs",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "containernetworking-plugins",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-tools",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "golang-github-prometheus-promu",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ignition",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kata-containers",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "microshift",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/frr-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-ansible-operator",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/ose-cli",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-hypershift-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-clients",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-kuryr",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ose-aws-ecr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ose-azure-acr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ose-crio-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ose-gcp-gcr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "podman",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "rh-osbs/openshift-golang-builder",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "runc",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "skopeo",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "devspaces/udi-rhel9",
            "product": "Red Hat OpenShift Dev Spaces",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:devworkspace"
            ],
            "defaultStatus": "affected",
            "packageName": "devworkspace/devworkspace-rhel9-operator",
            "product": "Red Hat OpenShift Dev Workspaces Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_distributed_tracing:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosdt/tempo-rhel9",
            "product": "Red Hat OpenShift distributed tracing 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:windows_machine_config"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator",
            "product": "Red Hat OpenShift for Windows Containers",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_gitops:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-gitops-1/dex-rhel8",
            "product": "Red Hat OpenShift GitOps",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_gitops:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-gitops-1/dex-rhel9",
            "product": "Red Hat OpenShift GitOps",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_service_on_aws:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rosa",
            "product": "Red Hat OpenShift on AWS",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-native-virtualization/kubevirt-apiserver-proxy-rhel9",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-native-virtualization/kubevirt-redfish-rhel9",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kubevirt",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "affected",
            "packageName": "rh-osbs/openshift-golang-builder",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "etcd",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang-github-infrawatch-apputils",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "affected",
            "packageName": "collectd-libpod-stats",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "etcd",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "affected",
            "packageName": "golang-github-infrawatch-apputils",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-rhel9/osp-director-agent",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0"
            ],
            "defaultStatus": "affected",
            "packageName": "golang-github-openstack-k8s-operators-os-diff",
            "product": "Red Hat OpenStack Platform 18.0",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoso-operators/sg-core-rhel9",
            "product": "Red Hat OpenStack Platform 18.0",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quay:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quay:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "quay/quay-rhel9",
            "product": "Red Hat Quay 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "affected",
            "packageName": "satellite:el8/yggdrasil-worker-forwarder",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "satellite/iop-vmaas-rhel9",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_interconnect:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "skupper-cli",
            "product": "Red Hat Service Interconnect 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_security_profiles_operator:1"
            ],
            "defaultStatus": "affected",
            "packageName": "compliance/openshift-selinuxd-rhel8",
            "product": "Security Profiles Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:stf:1.5"
            ],
            "defaultStatus": "unaffected",
            "packageName": "stf/sg-core-rhel9",
            "product": "Service Telemetry Framework 1.5",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang-github-danielqsj-kafka_exporter",
            "product": "streams for Apache Kafka 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "zero-trust-workload-identity-manager/spiffe-csi-driver-rhel9",
            "product": "Zero Trust Workload Identity Manager",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
            ],
            "defaultStatus": "affected",
            "packageName": "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9",
            "product": "Zero Trust Workload Identity Manager - Tech Preview",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-02T22:01:36.954Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-606",
                "description": "Unchecked Input for Loop Condition",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T12:04:17.927Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-27145"
          },
          {
            "name": "RHBZ#2484207",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42079"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42080"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53416"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50319"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54757"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57482"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42082"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42150"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42151"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42240"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49703"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49702"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53413"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53374"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54168"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51187"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:46394"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:46395"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29980"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35832"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34357"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39005"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42946"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39573"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38995"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41930"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61253"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60354"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57649"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53412"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60315"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49712"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53415"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54401"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29981"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34359"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39879"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36317"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54531"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61314"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54500"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41030"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44622"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47149"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53530"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:52946"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66022"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51057"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60387"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47737"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60390"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60388"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54427"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60391"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60386"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:63016"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42142"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33574"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23262"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23264"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54441"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36648"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41036"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60025"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57488"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54603"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49705"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49729"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49744"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49765"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49770"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50205"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36797"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42043"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42047"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42050"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42051"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42049"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55899"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54435"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54525"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57194"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59556"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59593"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59557"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54432"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59579"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59558"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47735"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59559"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:42079: Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42080: Red Hat Ansible Automation Platform 2.7 for RHEL 10, Red Hat Ansible Automation Platform 2.7 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53416: Red Hat Enterprise Linux Server (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:50319: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54757: Red Hat OpenStack Platform 16.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57482: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42082: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42150: Red Hat Satellite 6.17 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42151: Red Hat Satellite 6.18 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42240: Red Hat Satellite 6.19 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49703: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49702: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53413: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53374: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54168: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51187: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:46394: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:46395: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29980: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35832: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34357: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39005: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42946: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39573: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:38995: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41930: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:61253: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60354: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57649: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53412: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60315: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49712: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53415: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54401: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29981: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34359: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39879: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36317: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54531: Cert Manager support for Red Hat OpenShift release 1.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:61314: Cluster Observability Operator 1.5.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54500: Compliance Operator 1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41030: Multicluster Global Hub 1.4.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44622: Multicluster Global Hub 1.6.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47149: Multicluster Global Hub 1.7.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53530: Multicluster Global Hub 1.7.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:52946: Multicluster Global Hub 1.8.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66022: OpenShift API for Data Protection 1.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51057: OpenShift Developer Tools and Services 1.6.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60387: Red Hat Advanced Cluster Management for Kubernetes 2.11"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47737: Red Hat Advanced Cluster Management for Kubernetes 2.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60390: Red Hat Advanced Cluster Management for Kubernetes 2.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60388: Red Hat Advanced Cluster Management for Kubernetes 2.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54427: Red Hat Advanced Cluster Management for Kubernetes 2.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60391: Red Hat Advanced Cluster Management for Kubernetes 2.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60386: Red Hat Advanced Cluster Management for Kubernetes 2.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:63016: Red Hat Advanced Cluster Management for Kubernetes 2.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42142: Red Hat Ansible Automation Platform 2.7"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33574: Red Hat Developer Hub 1.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23262: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23264: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54441: Red Hat Lightspeed (formerly Insights) for Runtimes 1.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36648: Red Hat OpenShift Builds 1.7.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41036: Red Hat OpenShift Builds 1.8.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60025: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57488: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54603: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49705: Red Hat OpenShift Service Mesh 3.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49729: Red Hat OpenShift Service Mesh 3.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49744: Red Hat OpenShift Service Mesh 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49765: Red Hat OpenShift Service Mesh 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49770: Red Hat OpenShift Service Mesh 3.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:50205: Red Hat OpenShift distributed tracing 3.10.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36797: Red Hat Trusted Artifact Signer 1.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42043: Red Hat Web Terminal 1.11"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42047: Red Hat Web Terminal 1.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42050: Red Hat Web Terminal 1.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42051: Red Hat Web Terminal 1.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42049: Red Hat Web Terminal 1.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55899: Red Hat Web Terminal 1.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54525: external secrets operator for Red Hat OpenShift 1.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57194: multicluster engine for Kubernetes 2.11"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59556: multicluster engine for Kubernetes 2.11"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59593: multicluster engine for Kubernetes 2.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59557: multicluster engine for Kubernetes 2.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54432: multicluster engine for Kubernetes 2.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59579: multicluster engine for Kubernetes 2.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59558: multicluster engine for Kubernetes 2.8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47735: multicluster engine for Kubernetes 2.8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59559: multicluster engine for Kubernetes 2.9"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-02T23:01:08.992Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-02T22:01:36.954Z",
            "value": "Made public."
          }
        ],
        "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
        "workarounds": [
          {
            "lang": "en",
            "value": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037)."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/x509",
          "product": "crypto/x509",
          "programRoutines": [
            {
              "name": "HostnameError.Error"
            },
            {
              "name": "matchHostnames"
            },
            {
              "name": "Certificate.Verify"
            },
            {
              "name": "Certificate.VerifyHostname"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.4",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jakub Ciolek - https://ciolek.dev/"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname\u0027s label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T22:01:36.954Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/783621"
        },
        {
          "url": "https://go.dev/issue/79694"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5037"
        }
      ],
      "title": "Inefficient candidate hostname parsing in crypto/x509"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-27145",
    "datePublished": "2026-06-02T22:01:36.954Z",
    "dateReserved": "2026-02-17T19:57:28.435Z",
    "dateUpdated": "2026-09-16T12:04:17.927Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33818 (GCVE-0-2026-33818)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-09-15 19:00

Title

Enforce maximum recursion depth in encoding/asn1

Summary

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:11 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/80405
https://groups.google.com/g/golang-announce/c/94p…
https://go.dev/cl/814980
https://pkg.go.dev/vuln/GO-2026-5972

Impacted products

1 product

Vendor	Product	Version
Go standard library	encoding/asn1	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Credits

Marwan Atia (marwansamir688@gmail.com)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-33818",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:11:19.904646Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:12:34.877Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "encoding/asn1",
          "product": "encoding/asn1",
          "programRoutines": [
            {
              "name": "parseSequenceOf"
            },
            {
              "name": "parseField"
            },
            {
              "name": "UnmarshalWithParams"
            },
            {
              "name": "Unmarshal"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Marwan Atia (marwansamir688@gmail.com)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T19:00:20.553Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80405"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://go.dev/cl/814980"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "title": "Enforce maximum recursion depth in encoding/asn1"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-33818",
    "datePublished": "2026-08-13T21:58:52.821Z",
    "dateReserved": "2026-03-23T20:35:32.815Z",
    "dateUpdated": "2026-09-15T19:00:20.553Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41178 (GCVE-0-2026-41178)

Vulnerability from cvelistv5 – Published: 2026-06-04 14:38 – Updated: 2026-06-04 15:46

Title

OpenTelemetry-Go's baggage parsing no longer caps raw header length

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-04 15:46 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
open-telemetry	go.opentelemetry.io/otel/baggage	Affected: = 1.41.0 Affected: = 1.43.0
open-telemetry	go.opentelemetry.io/otel/propagation	Affected: = 1.41.0 Affected: = 1.43.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41178",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T15:46:06.715583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-04T15:46:11.923Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go.opentelemetry.io/otel/baggage",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.41.0"
            },
            {
              "status": "affected",
              "version": "= 1.43.0"
            }
          ]
        },
        {
          "product": "go.opentelemetry.io/otel/propagation",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.41.0"
            },
            {
              "status": "affected",
              "version": "= 1.43.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T14:38:23.707Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/pull/7880",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/pull/7880"
        }
      ],
      "source": {
        "advisory": "GHSA-5wrp-cwcj-q835",
        "discovery": "UNKNOWN"
      },
      "title": "OpenTelemetry-Go\u0027s baggage parsing no longer caps raw header length"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41178",
    "datePublished": "2026-06-04T14:38:23.707Z",
    "dateReserved": "2026-04-17T16:34:45.526Z",
    "dateUpdated": "2026-06-04T15:46:11.923Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44740 (GCVE-0-2026-44740)

Vulnerability from cvelistv5 – Published: 2026-06-01 16:04 – Updated: 2026-06-01 18:14

Title

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

Summary

Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-01 18:13 UTC

CWE

CWE-674 - Uncontrolled Recursion
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/go-git/go-billy/security/advis…	x_refsource_CONFIRM
https://github.com/go-git/go-billy/releases/tag/v5.9.0	x_refsource_MISC
https://github.com/go-git/go-billy/releases/tag/v…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
go-git	go-billy	Affected: < 5.9.0 Affected: < 6.0.0-alpha.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44740",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T18:13:54.236447Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-01T18:14:04.315Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go-billy",
          "vendor": "go-git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.9.0"
            },
            {
              "status": "affected",
              "version": "\u003c 6.0.0-alpha.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T16:04:50.358Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6"
        },
        {
          "name": "https://github.com/go-git/go-billy/releases/tag/v5.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-git/go-billy/releases/tag/v5.9.0"
        },
        {
          "name": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1"
        }
      ],
      "source": {
        "advisory": "GHSA-m3xc-h892-ggx6",
        "discovery": "UNKNOWN"
      },
      "title": "go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44740",
    "datePublished": "2026-06-01T16:04:50.358Z",
    "dateReserved": "2026-05-07T18:04:17.310Z",
    "dateUpdated": "2026-06-01T18:14:04.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48050 (GCVE-0-2026-48050)

Vulnerability from cvelistv5 – Published: 2026-08-21 22:40 – Updated: 2026-08-25 16:44

Title

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

Summary

Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cmd/arc/main.go`. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication. Version 26.06.1 contains a patch. Some workarounds are available. Block `/debug/pprof*` at a reverse proxy / load balancer in front of Arc, restrict Arc's API port to known-trusted networks via firewall rules, and/or patch the running build: comment out `app.Use(pprof.New())` in `internal/api/server.go` and rebuild.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 16:44 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-306 - Missing Authentication for Critical Function
CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/Basekick-Labs/arc/security/adv…	x_refsource_CONFIRM
https://github.com/Basekick-Labs/arc/commit/32a40…	x_refsource_MISC
https://github.com/Basekick-Labs/arc/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Basekick-Labs	arc	Affected: < 26.06.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48050",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T16:44:13.830681Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T16:44:36.584Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "arc",
          "vendor": "Basekick-Labs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.06.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go\u0027s `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cmd/arc/main.go`. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication. Version 26.06.1 contains a patch. Some workarounds are available. Block `/debug/pprof*` at a reverse proxy / load balancer in front of Arc, restrict Arc\u0027s API port to known-trusted networks via firewall rules, and/or patch the running build: comment out `app.Use(pprof.New())` in `internal/api/server.go` and rebuild."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T22:40:12.771Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Basekick-Labs/arc/security/advisories/GHSA-j93g-rp6m-j32m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Basekick-Labs/arc/security/advisories/GHSA-j93g-rp6m-j32m"
        },
        {
          "name": "https://github.com/Basekick-Labs/arc/commit/32a4091fb949f9cf060cdd804a07f6450dc426a8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Basekick-Labs/arc/commit/32a4091fb949f9cf060cdd804a07f6450dc426a8"
        },
        {
          "name": "https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1"
        }
      ],
      "source": {
        "advisory": "GHSA-j93g-rp6m-j32m",
        "discovery": "UNKNOWN"
      },
      "title": "Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48050",
    "datePublished": "2026-08-21T22:40:12.771Z",
    "dateReserved": "2026-05-20T18:15:53.578Z",
    "dateUpdated": "2026-08-25T16:44:36.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56852 (GCVE-0-2026-56852)

Vulnerability from cvelistv5 – Published: 2026-07-21 19:18 – Updated: 2026-08-10 22:57

Title

Infinite loop on invalid input in golang.org/x/text

Summary

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 13:26 UTC

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

Go Google root

References

3 references

URL	Tags
https://go.dev/issue/80142
https://go.dev/cl/794100
https://pkg.go.dev/vuln/GO-2026-5970

Impacted products

1 product

Vendor	Product	Version
golang.org/x/text	golang.org/x/text/unicode/norm	Affected: 0 , < 0.39.0 (semver)

Credits

Viky Choi ("vikychoi" on GitHub)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56852",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T13:26:14.918983Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-835",
                "description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T13:26:20.232Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/text/unicode/norm",
          "product": "golang.org/x/text/unicode/norm",
          "programRoutines": [
            {
              "name": "nextComposed"
            },
            {
              "name": "Form.Append"
            },
            {
              "name": "Form.AppendString"
            },
            {
              "name": "Form.Bytes"
            },
            {
              "name": "Form.FirstBoundary"
            },
            {
              "name": "Form.FirstBoundaryInString"
            },
            {
              "name": "Form.IsNormal"
            },
            {
              "name": "Form.IsNormalString"
            },
            {
              "name": "Form.LastBoundary"
            },
            {
              "name": "Form.NextBoundary"
            },
            {
              "name": "Form.NextBoundaryInString"
            },
            {
              "name": "Form.Properties"
            },
            {
              "name": "Form.PropertiesString"
            },
            {
              "name": "Form.QuickSpan"
            },
            {
              "name": "Form.QuickSpanString"
            },
            {
              "name": "Form.Span"
            },
            {
              "name": "Form.SpanString"
            },
            {
              "name": "Form.String"
            },
            {
              "name": "Form.Transform"
            },
            {
              "name": "Iter.Init"
            },
            {
              "name": "Iter.InitString"
            },
            {
              "name": "Iter.Next"
            },
            {
              "name": "Iter.Seek"
            },
            {
              "name": "normReader.Read"
            },
            {
              "name": "normWriter.Write"
            }
          ],
          "vendor": "golang.org/x/text",
          "versions": [
            {
              "lessThan": "0.39.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Viky Choi (\"vikychoi\" on GitHub)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T22:57:54.703Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80142"
        },
        {
          "url": "https://go.dev/cl/794100"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "title": "Infinite loop on invalid input in golang.org/x/text"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56852",
    "datePublished": "2026-07-21T19:18:59.951Z",
    "dateReserved": "2026-06-23T15:10:49.352Z",
    "dateUpdated": "2026-08-10T22:57:54.703Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56853 (GCVE-0-2026-56853)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:23

Title

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Summary

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:22 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/80205
https://go.dev/cl/795540
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6089

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/http	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56853",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:22:45.475320Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:23:18.680Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "conn.readRequest"
            },
            {
              "name": "conn.serve"
            },
            {
              "name": "ListenAndServe"
            },
            {
              "name": "ListenAndServeTLS"
            },
            {
              "name": "Serve"
            },
            {
              "name": "ServeTLS"
            },
            {
              "name": "Server.ListenAndServe"
            },
            {
              "name": "Server.ListenAndServeTLS"
            },
            {
              "name": "Server.Serve"
            },
            {
              "name": "Server.ServeTLS"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.092Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80205"
        },
        {
          "url": "https://go.dev/cl/795540"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6089"
        }
      ],
      "title": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56853",
    "datePublished": "2026-08-13T21:58:53.092Z",
    "dateReserved": "2026-06-23T15:10:49.352Z",
    "dateUpdated": "2026-08-14T15:23:18.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56858 (GCVE-0-2026-56858)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:32

Title

Fix Javascript regexp context tracking in html/template

Summary

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:31 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/80435
https://go.dev/cl/807100
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6091

Impacted products

1 product

Vendor	Product	Version
Go standard library	html/template	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Credits

Ali Sherif

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:31:30.140536Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:32:29.852Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "html/template",
          "product": "html/template",
          "programRoutines": [
            {
              "name": "tJS"
            },
            {
              "name": "Template.Execute"
            },
            {
              "name": "Template.ExecuteTemplate"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Ali Sherif"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, pathological inputs could close an unescaped \u0027/\u0027 early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.354Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80435"
        },
        {
          "url": "https://go.dev/cl/807100"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6091"
        }
      ],
      "title": "Fix Javascript regexp context tracking in html/template"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56858",
    "datePublished": "2026-08-13T21:58:53.354Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T15:32:29.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56859 (GCVE-0-2026-56859)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:21

Title

Add recursion depth guard during decode in encoding/xml

Summary

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:21 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/80481
https://go.dev/cl/803320
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6088

Impacted products

1 product

Vendor	Product	Version
Go standard library	encoding/xml	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56859",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:21:09.615961Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:21:46.218Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "encoding/xml",
          "product": "encoding/xml",
          "programRoutines": [
            {
              "name": "Decoder.push"
            },
            {
              "name": "Decoder.pop"
            },
            {
              "name": "Decoder.RawToken"
            },
            {
              "name": "Decoder.unmarshalPath"
            },
            {
              "name": "Decoder.unmarshal"
            },
            {
              "name": "Decoder.Decode"
            },
            {
              "name": "Decoder.DecodeElement"
            },
            {
              "name": "Decoder.Skip"
            },
            {
              "name": "Decoder.Token"
            },
            {
              "name": "Unmarshal"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:52.959Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80481"
        },
        {
          "url": "https://go.dev/cl/803320"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6088"
        }
      ],
      "title": "Add recursion depth guard during decode in encoding/xml"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56859",
    "datePublished": "2026-08-13T21:58:52.959Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T15:21:46.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56860 (GCVE-0-2026-56860)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 16:14

Title

Avoid quadratic complexity in resolvePath in net/url

Summary

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 16:14 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/cl/803681
https://go.dev/issue/80494
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6218

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/url	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56860",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T16:14:34.601382Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-407",
                "description": "CWE-407 Inefficient Algorithmic Complexity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T16:14:39.166Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/url",
          "product": "net/url",
          "programRoutines": [
            {
              "name": "resolvePath"
            },
            {
              "name": "URL.Parse"
            },
            {
              "name": "URL.ResolveReference"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, resolving relative paths containing parent directory (\u0027..\u0027) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for \u0027..\u0027 segments, eliminating the quadratic time complexity and significantly reducing memory allocations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.731Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/803681"
        },
        {
          "url": "https://go.dev/issue/80494"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "title": "Avoid quadratic complexity in resolvePath in net/url"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56860",
    "datePublished": "2026-08-13T21:58:53.731Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T16:14:39.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:68335

CVE-2026-27145 (GCVE-0-2026-27145)

CVE-2026-33818 (GCVE-0-2026-33818)

CVE-2026-41178 (GCVE-0-2026-41178)

CVE-2026-44740 (GCVE-0-2026-44740)

CVE-2026-48050 (GCVE-0-2026-48050)

CVE-2026-56852 (GCVE-0-2026-56852)

CVE-2026-56853 (GCVE-0-2026-56853)

CVE-2026-56858 (GCVE-0-2026-56858)

CVE-2026-56859 (GCVE-0-2026-56859)

CVE-2026-56860 (GCVE-0-2026-56860)

Tags

Sightings

Nomenclature

Related by attack behaviour