{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated OpenShift Compliance Operator image that fixes various bugs and adds new\nenhancements is now available for the Red Hat OpenShift Enterprise 4 catalog.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The OpenShift Compliance Operator v1.9.0 is now available.\nSee the documentation for bug fix information:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/compliance-operator#compliance-operator-release-notes",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:8433",
        "url": "https://access.redhat.com/errata/RHSA-2026:8433"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-52881",
        "url": "https://access.redhat.com/security/cve/CVE-2025-52881"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61726",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61726"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61729",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61729"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-68121",
        "url": "https://access.redhat.com/security/cve/CVE-2025-68121"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
        "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33186"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4645",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4645"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8433.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Compliance Operator bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-07-26T08:15:23+00:00",
      "generator": {
        "date": "2026-07-26T08:15:23+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2026:8433",
      "initial_release_date": "2026-04-16T10:06:55+00:00",
      "revision_history": [
        {
          "date": "2026-04-16T10:06:55+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-25T05:39:32+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-26T08:15:23+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "OpenShift Compliance Operator 1",
                "product": {
                  "name": "OpenShift Compliance Operator 1",
                  "product_id": "OpenShift Compliance Operator 1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_compliance_operator:1::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "OpenShift Compliance Operator"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-operator-bundle@sha256%3Ae2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da?arch=amd64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776237332"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-content-rhel8@sha256%3A5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175?arch=amd64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776170256"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-must-gather-rhel8@sha256%3Ab6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40?arch=amd64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1775641344"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-openscap-rhel8@sha256%3A9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed?arch=amd64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1775641480"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-rhel8-operator@sha256%3A45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb?arch=amd64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776235578"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-content-rhel8@sha256%3A59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089?arch=arm64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776170256"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-must-gather-rhel8@sha256%3A25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb?arch=arm64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1775641344"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-openscap-rhel8@sha256%3Aee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62?arch=arm64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1775641480"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-rhel8-operator@sha256%3Aff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487?arch=arm64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776235578"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-content-rhel8@sha256%3Aa80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776170256"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-must-gather-rhel8@sha256%3A55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance\u0026tag=1775641344"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-openscap-rhel8@sha256%3A62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance\u0026tag=1775641480"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-rhel8-operator@sha256%3Af3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776235578"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-content-rhel8@sha256%3A1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac?arch=s390x\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776170256"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-must-gather-rhel8@sha256%3A2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139?arch=s390x\u0026repository_url=registry.redhat.io/compliance\u0026tag=1775641344"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-openscap-rhel8@sha256%3Ae0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7?arch=s390x\u0026repository_url=registry.redhat.io/compliance\u0026tag=1775641480"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
                "product": {
                  "name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
                  "product_id": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-rhel8-operator@sha256%3Ab1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539?arch=s390x\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776235578"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64 as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64 as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64 as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64 as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64 as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64 as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64 as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64 as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64 as a component of OpenShift Compliance Operator 1",
          "product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
        },
        "product_reference": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64",
        "relates_to_product_reference": "OpenShift Compliance Operator 1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-52881",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2025-10-17T14:19:18.652000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2404715"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in runc. This attack is a more sophisticated variant of CVE-2019-16884, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation applied for CVE-2019-16884 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat considers this as an Important flaw since the impact is limited to local attack with minimal privileges in order to jeopardize the environment.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64"
        ],
        "known_not_affected": [
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-52881"
        },
        {
          "category": "external",
          "summary": "RHBZ#2404715",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2404715"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52881",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-52881"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52881",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52881"
        },
        {
          "category": "external",
          "summary": "https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm",
          "url": "https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm"
        },
        {
          "category": "external",
          "summary": "https://github.com/opencontainers/selinux/pull/237",
          "url": "https://github.com/opencontainers/selinux/pull/237"
        }
      ],
      "release_date": "2025-11-05T09:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T10:06:55+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n  \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8433"
        },
        {
          "category": "workaround",
          "details": "Potential mitigations for this issue include:\n\n* Using rootless containers, as doing so will block most of the inadvertent writes (runc would run with reduced privileges, making attempts to write to procfs files ineffective).\n* Based on our analysis, neither AppArmor or SELinux can protect against the full version of the redirected write attack. The container runtime is generally privileged enough to write to arbitrary procfs files, which is more than sufficient to cause a container breakout.",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects"
    },
    {
      "cve": "CVE-2025-61726",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-01-28T20:01:42.791305+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2434432"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
        ],
        "known_not_affected": [
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "RHBZ#2434432",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/736712",
          "url": "https://go.dev/cl/736712"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77101",
          "url": "https://go.dev/issue/77101"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4341",
          "url": "https://pkg.go.dev/vuln/GO-2026-4341"
        }
      ],
      "release_date": "2026-01-28T19:30:31.215000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T10:06:55+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n  \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8433"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "cve": "CVE-2025-61729",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2025-12-02T20:01:45.330964+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2418462"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang. A remote attacker could exploit this vulnerability by providing a specially crafted certificate during the error string construction process within the `HostnameError.Error()` function. This flaw, caused by unbounded string concatenation, leads to excessive resource consumption. Successful exploitation can result in a denial of service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
        ],
        "known_not_affected": [
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61729"
        },
        {
          "category": "external",
          "summary": "RHBZ#2418462",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418462"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61729",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61729"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/725920",
          "url": "https://go.dev/cl/725920"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/76445",
          "url": "https://go.dev/issue/76445"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4",
          "url": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4155",
          "url": "https://pkg.go.dev/vuln/GO-2025-4155"
        }
      ],
      "release_date": "2025-12-02T18:54:10.166000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T10:06:55+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n  \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8433"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "cve": "CVE-2025-68121",
      "discovery_date": "2026-02-05T18:01:30.086058+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2437111"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
        ],
        "known_not_affected": [
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "RHBZ#2437111",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/737700",
          "url": "https://go.dev/cl/737700"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77217",
          "url": "https://go.dev/issue/77217"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
          "url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4337",
          "url": "https://pkg.go.dev/vuln/GO-2026-4337"
        }
      ],
      "release_date": "2026-02-05T17:48:44.141000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T10:06:55+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n  \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8433"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "cve": "CVE-2026-4645",
      "discovery_date": "2026-03-23T06:02:52.120840+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `github.com/antchfx/xpath` component. A remote attacker could exploit this vulnerability by submitting crafted Boolean XPath expressions that evaluate to true. This can cause an infinite loop in the `logicalQuery.Select` function, leading to 100% CPU utilization and a Denial of Service (DoS) condition for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "A denial of service vulnerability was discovered in `github.com/antchfx/xpath`, with Important severity. Systems processing untrusted XPath expressions are vulnerable to an infinite loop, leading to 100% CPU utilization which would impact normal operations of the system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
        ],
        "known_not_affected": [
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4645"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4645",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4645"
        }
      ],
      "release_date": "2026-03-17T20:58:59+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T10:06:55+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n  \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8433"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict the processing of untrusted or unvalidated XPath expressions by applications which utilize the `github.com/antchfx/xpath` component. Implement input validation and sanitization for all XPath expressions originating from external or untrusted sources. If possible, configure applications to only process XPath expressions from trusted sources or disable features that allow arbitrary XPath expression evaluation.",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/antchfx/xpath: xpath: Denial of Service via crafted Boolean XPath expressions"
    },
    {
      "cve": "CVE-2026-25679",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-03-06T22:02:11.567841+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445356"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
        ],
        "known_not_affected": [
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445356",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/752180",
          "url": "https://go.dev/cl/752180"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77578",
          "url": "https://go.dev/issue/77578"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4601",
          "url": "https://pkg.go.dev/vuln/GO-2026-4601"
        }
      ],
      "release_date": "2026-03-06T21:28:14.211000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T10:06:55+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n  \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8433"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "cve": "CVE-2026-33186",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-03-20T23:02:27.802640+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449833"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
        ],
        "known_not_affected": [
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
          "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449833",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
        }
      ],
      "release_date": "2026-03-20T22:23:32.147000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T10:06:55+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n  \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8433"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
          "product_ids": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
            "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
    }
  ]
}