{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new satellite/iop-vulnerability-frontend-rhel9 container image is now available as a technical preview in the Red Hat container registry.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying  predefined rules to a small set of local data, such as installed packages,  running services, and configuration settings.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:74633",
        "url": "https://access.redhat.com/errata/RHSA-2026:74633"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-75899",
        "url": "https://access.redhat.com/security/cve/CVE-2026-75899"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84292",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84292"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84394",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84394"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/software/containers/search",
        "url": "https://catalog.redhat.com/software/containers/search"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74633.json"
      }
    ],
    "title": "Red Hat Security Advisory: Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image",
    "tracking": {
      "current_release_date": "2026-10-02T17:42:39+00:00",
      "generator": {
        "date": "2026-10-02T17:42:39+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:74633",
      "initial_release_date": "2026-10-01T20:11:46+00:00",
      "revision_history": [
        {
          "date": "2026-10-01T20:11:46+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-01T20:11:50+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-02T17:42:39+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.18",
                "product": {
                  "name": "Red Hat Satellite 6.18",
                  "product_id": "Red Hat Satellite 6.18",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6.18::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64",
                "product": {
                  "name": "registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64",
                  "product_id": "registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/iop-vulnerability-frontend-rhel9@sha256%3Ac21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64?arch=amd64\u0026repository_url=registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9\u0026tag=1790483608"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64 as a component of Red Hat Satellite 6.18",
          "product_id": "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64"
        },
        "product_reference": "registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64",
        "relates_to_product_reference": "Red Hat Satellite 6.18"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-75899",
      "cwe": {
        "id": "CWE-140",
        "name": "Improper Neutralization of Delimiters"
      },
      "discovery_date": "2026-08-24T09:51:05.559475+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2521778"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a loopback address. This vulnerability can lead to Server-Side Request Forgery (SSRF) and bypass host-based security policies.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in the `fast-uri` library, used by applications for URI parsing, allows for Server-Side Request Forgery (SSRF) and host-policy bypass. By crafting a doubly percent-encoded hostname in an untrusted HTTP-family URI, an attacker could redirect internal application requests to arbitrary network destinations, potentially bypassing security controls and accessing internal services. This risk is present in Red Hat products that process untrusted URIs using affected versions of `fast-uri`.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-75899"
        },
        {
          "category": "external",
          "summary": "RHBZ#2521778",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521778"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-75899",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75899"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75899",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75899"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf"
        }
      ],
      "release_date": "2026-08-24T09:40:19.801000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:11:46+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74633"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding"
    },
    {
      "cve": "CVE-2026-84292",
      "cwe": {
        "id": "CWE-140",
        "name": "Improper Neutralization of Delimiters"
      },
      "discovery_date": "2026-09-02T20:21:15.599288+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2527747"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier (URI) without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker\u0027s host as legitimate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw. Applications utilizing the `fast-uri` library in Red Hat environments are susceptible to authority injection if they process untrusted data as the port component of a URI. This could allow an attacker to redirect network traffic to an arbitrary host, compromising communication integrity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84292"
        },
        {
          "category": "external",
          "summary": "RHBZ#2527747",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527747"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84292",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84292"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84292",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84292"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3"
        }
      ],
      "release_date": "2026-09-02T20:09:51.415000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:11:46+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74633"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization"
    },
    {
      "cve": "CVE-2026-84394",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-09-02T20:31:21.036047+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2527756"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier (URI) hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policies, such as Server-Side Request Forgery (SSRF) denylists or redirect allowlists, by causing an application to evaluate its policy against an incorrect host string. This could result in unintended network requests or access to unauthorized resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can exploit URI parsing discrepancies to bypass critical host-level access restrictions, such as SSRF filters or reverse proxy routing, without needing elevated privileges. Within Red Hat environments, the issue primarily impacts services that rely on fast-uri to validate external destinations before dispatching requests via Node.js HTTP clients. Product components that only provide frontend interfaces or do not evaluate host security policies using the parsed authority data are not exposed to security filter circumvention.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84394"
        },
        {
          "category": "external",
          "summary": "RHBZ#2527756",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527756"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84394",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84394"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84394",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84394"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g"
        }
      ],
      "release_date": "2026-09-02T20:25:35.399000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:11:46+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74633"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:c21654bddc8120fe9d70db3b7c0b272dc542bf066a5ad5d90b922d993cc16b64_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies"
    }
  ]
}