RHSA-2026:85846

Vulnerability from csaf_redhat - Published: 2026-10-20 08:18 - Updated: 2026-10-27 04:08
Summary
Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.18 security and bug fix update
Severity
Important
Notes
Topic: The Migration Toolkit for Containers (MTC) 1.8.18 is now available.
Details: The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-33186

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64 —
Workaround
Threats
Impact Important
CVE-2026-59879

A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as List#set or List#setSize, are provided with an index or size value within a particular large range. An attacker could exploit this by providing specially crafted input, leading to an uncatchable infinite loop or unbounded memory allocation, ultimately causing a Denial of Service (DoS) for applications using the library.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64 —
Workaround
Threats
Impact Moderate
CVE-2026-69153

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 1 product, the same list as for CVE-2026-59879
Known not affected 10 products, the same list as for CVE-2026-59879
Threats
Impact Moderate
CVE-2026-84445

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer() can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a Denial of Service (DoS). In some deployments, this attack can be unauthenticated.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64 —
Vendor Fix fix
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64 —
Vendor Fix fix
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64 —
Vendor Fix fix
Product Identifier Version Remediation
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64 —
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64 —
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64 —
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64 —
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64 —
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64 —
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64 —
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64 —
Threats
Impact Important
CVE-2026-87776

A flaw was found in the `compression` Node.js and Express middleware. A remote unauthenticated attacker can exploit this vulnerability by repeatedly initiating and then prematurely aborting connections while compressed responses are being sent. This action prevents the zlib stream, used for compression, from being properly destroyed, leading to a memory leak. Over time, this memory exhaustion can cause the server to crash, resulting in a Denial of Service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Fixed 1 product, the same list as for CVE-2026-59879
Known not affected 10 products, the same list as for CVE-2026-59879
Threats
Impact Important
CVE-2026-88031

A flaw was found in go.mongodb.org/mongo-driver for version < 1.17.10 and < 2.9.1. Improper handling of data query elements in the GridFS component can lead to a file identifier being misinterpreted as a query. An authenticated user can exploit this to delete all GridFS file chunks, making stored file content unreadable, resulting in a denial of service.

8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CWE-1287 - Improper Validation of Specified Type of Input
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64 —
Workaround
Unresolved product id: Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64 —
Workaround
Threats
Impact Important
CVE-2026-90711

A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this vulnerability by submitting a forged X-Forwarded-For header to spoof their client IP address. This flaw allows attackers to bypass IP-based access controls, rate limiting, and audit logging.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-290 - Authentication Bypass by Spoofing
Affected products
Fixed 1 product, the same list as for CVE-2026-59879
Known not affected 10 products, the same list as for CVE-2026-59879
Threats
Impact Important
CVE-2026-92599

A flaw was found in joi. A remote attacker can exploit an unanchored regular expression in the `Joi.string().isoDate()` validation rule by supplying a specially crafted string. This input, consisting of a valid ISO date followed by a long sequence of fractional-second digits, causes the regular expression engine to consume excessive processing time. This vulnerability leads to a Regular Expression Denial of Service (ReDoS), allowing the attacker to stall the application with a single request.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1333 - Inefficient Regular Expression Complexity
Affected products
Fixed 1 product, the same list as for CVE-2026-59879
Known not affected 10 products, the same list as for CVE-2026-59879
Threats
Impact Important
CVE-2026-93749

A flaw was found in source-map-js. This vulnerability allows a remote attacker to trigger a denial of service by providing malformed input. Specifically, by supplying extremely large offset line values in indexed source maps, the attacker can cause the service's event loop to block, making it unable to process further requests.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input
Affected products
Fixed 1 product, the same list as for CVE-2026-59879
Known not affected 10 products, the same list as for CVE-2026-59879
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:85846 self
https://access.redhat.com/security/cve/CVE-2026-33186 external
https://access.redhat.com/security/cve/CVE-2026-59879 external
https://access.redhat.com/security/cve/CVE-2026-69153 external
https://access.redhat.com/security/cve/CVE-2026-84445 external
https://access.redhat.com/security/cve/CVE-2026-87776 external
https://access.redhat.com/security/cve/CVE-2026-88031 external
https://access.redhat.com/security/cve/CVE-2026-90711 external
https://access.redhat.com/security/cve/CVE-2026-92599 external
https://access.redhat.com/security/cve/CVE-2026-93749 external
https://access.redhat.com/security/updates/classi… external
https://docs.redhat.com/en/documentation/openshif… external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-33186 self
https://bugzilla.redhat.com/show_bug.cgi?id=2449833 external
https://www.cve.org/CVERecord?id=CVE-2026-33186 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 external
https://github.com/grpc/grpc-go/security/advisori… external
https://access.redhat.com/security/cve/CVE-2026-59879 self
https://bugzilla.redhat.com/show_bug.cgi?id=2498158 external
https://www.cve.org/CVERecord?id=CVE-2026-59879 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59879 external
https://github.com/immutable-js/immutable-js/comm… external
https://github.com/immutable-js/immutable-js/comm… external
https://github.com/immutable-js/immutable-js/rele… external
https://github.com/immutable-js/immutable-js/rele… external
https://github.com/immutable-js/immutable-js/secu… external
https://access.redhat.com/security/cve/CVE-2026-69153 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510719 external
https://www.cve.org/CVERecord?id=CVE-2026-69153 external
https://nvd.nist.gov/vuln/detail/CVE-2026-69153 external
https://github.com/postcss/postcss/commit/7beca13… external
https://github.com/postcss/postcss/releases/tag/8.5.19 external
https://github.com/postcss/postcss/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-84445 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533175 external
https://www.cve.org/CVERecord?id=CVE-2026-84445 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84445 external
https://github.com/grpc/grpc-go/commit/3822494d8e… external
https://github.com/grpc/grpc-go/commit/8668b69c16… external
https://github.com/grpc/grpc-go/commit/93e31b4854… external
https://github.com/grpc/grpc-go/issues/9354 external
https://github.com/grpc/grpc-go/pull/9365 external
https://github.com/grpc/grpc-go/pull/9366 external
https://github.com/grpc/grpc-go/pull/9367 external
https://github.com/grpc/grpc-go/releases/tag/v1.82.2 external
https://github.com/grpc/grpc-go/releases/tag/v1.83.2 external
https://github.com/grpc/grpc-go/security/advisori… external
https://access.redhat.com/security/cve/CVE-2026-87776 self
https://bugzilla.redhat.com/show_bug.cgi?id=2531852 external
https://www.cve.org/CVERecord?id=CVE-2026-87776 external
https://nvd.nist.gov/vuln/detail/CVE-2026-87776 external
https://cna.openjsf.org/security-advisories.html external
https://github.com/expressjs/compression/security… external
https://access.redhat.com/security/cve/CVE-2026-88031 self
https://bugzilla.redhat.com/show_bug.cgi?id=2531587 external
https://www.cve.org/CVERecord?id=CVE-2026-88031 external
https://nvd.nist.gov/vuln/detail/CVE-2026-88031 external
https://jira.mongodb.org/browse/GODRIVER-4081 external
https://www.mongodb.com/community/forums/t/mongod… external
https://access.redhat.com/security/cve/CVE-2026-90711 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533602 external
https://www.cve.org/CVERecord?id=CVE-2026-90711 external
https://nvd.nist.gov/vuln/detail/CVE-2026-90711 external
https://github.com/jshttp/proxy-addr/security/adv… external
https://access.redhat.com/security/cve/CVE-2026-92599 self
https://bugzilla.redhat.com/show_bug.cgi?id=2538354 external
https://www.cve.org/CVERecord?id=CVE-2026-92599 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92599 external
https://github.com/hapijs/joi/security/advisories… external
https://www.vulncheck.com/advisories/joi-before-1… external
https://access.redhat.com/security/cve/CVE-2026-93749 self
https://bugzilla.redhat.com/show_bug.cgi?id=2538368 external
https://www.cve.org/CVERecord?id=CVE-2026-93749 external
https://nvd.nist.gov/vuln/detail/CVE-2026-93749 external
https://github.com/7rulnik/source-map-js external
https://github.com/7rulnik/source-map-js/blob/c1c… external
https://github.com/7rulnik/source-map-js/issues/76 external
https://www.vulncheck.com/advisories/source-map-j… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The Migration Toolkit for Containers (MTC) 1.8.18 is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Migration Toolkit for Containers (MTC) enables you to migrate\nKubernetes resources, persistent volume data, and internal container images\nbetween OpenShift Container Platform clusters, using the MTC web console or\nthe Kubernetes API.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:85846",
        "url": "https://access.redhat.com/errata/RHSA-2026:85846"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33186"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59879",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59879"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69153",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69153"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84445",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84445"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-87776",
        "url": "https://access.redhat.com/security/cve/CVE-2026-87776"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-88031",
        "url": "https://access.redhat.com/security/cve/CVE-2026-88031"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-90711",
        "url": "https://access.redhat.com/security/cve/CVE-2026-90711"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-92599",
        "url": "https://access.redhat.com/security/cve/CVE-2026-92599"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-93749",
        "url": "https://access.redhat.com/security/cve/CVE-2026-93749"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/migration_toolkit_for_containers/index",
        "url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/migration_toolkit_for_containers/index"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85846.json"
      }
    ],
    "title": "Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.18 security and bug fix update",
    "tracking": {
      "current_release_date": "2026-10-27T04:08:44+00:00",
      "generator": {
        "date": "2026-10-27T04:08:44+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.3"
        }
      },
      "id": "RHSA-2026:85846",
      "initial_release_date": "2026-10-20T08:18:40+00:00",
      "revision_history": [
        {
          "date": "2026-10-20T08:18:40+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-20T08:18:45+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-27T04:08:44+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Migration Toolkit 1.8",
                "product": {
                  "name": "Red Hat Migration Toolkit 1.8",
                  "product_id": "Red Hat Migration Toolkit 1.8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhmt:1.8::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Migration Toolkit"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-controller-rhel8@sha256%3A8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-controller-rhel8\u0026tag=1791987924"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-hook-runner-rhel8@sha256%3Af3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8\u0026tag=1791926161"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-log-reader-rhel8@sha256%3A4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8\u0026tag=1791854351"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-must-gather-rhel8@sha256%3Ad33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8\u0026tag=1792066835"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-openvpn-rhel8@sha256%3A3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8\u0026tag=1792066862"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-rhel8-operator@sha256%3A020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-rhel8-operator\u0026tag=1792066855"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-operator-bundle@sha256%3A868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-operator-bundle\u0026tag=1792067362"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-registry-rhel8@sha256%3A18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-registry-rhel8\u0026tag=1791983931"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-rsync-transfer-rhel8@sha256%3Aeda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8\u0026tag=1791854349"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-ui-rhel8@sha256%3A925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-ui-rhel8\u0026tag=1791853281"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64",
                "product": {
                  "name": "registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64",
                  "product_id": "registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-migration-velero-plugin-for-mtc-rhel8@sha256%3Adf220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8\u0026tag=1791854357"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64 as a component of Red Hat Migration Toolkit 1.8",
          "product_id": "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
        },
        "product_reference": "registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64",
        "relates_to_product_reference": "Red Hat Migration Toolkit 1.8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-33186",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-03-20T23:02:27.802640+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449833"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449833",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
        }
      ],
      "release_date": "2026-03-20T22:23:32.147000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T08:18:40+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85846"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
    },
    {
      "cve": "CVE-2026-59879",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "discovery_date": "2026-07-08T17:02:16.432203+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498158"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as List#set or List#setSize, are provided with an index or size value within a particular large range. An attacker could exploit this by providing specially crafted input, leading to an uncatchable infinite loop or unbounded memory allocation, ultimately causing a Denial of Service (DoS) for applications using the library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact denial of service vulnerability in Immutable.js affects Red Hat products that process untrusted input through List operations. An attacker can trigger an infinite loop or unbounded memory allocation by providing specially crafted large index values, leading to a service disruption. Additionally, silent data corruption may occur due to integer wrapping.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59879"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498158",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498158"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59879",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59879"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59879",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59879"
        },
        {
          "category": "external",
          "summary": "https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84",
          "url": "https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84"
        },
        {
          "category": "external",
          "summary": "https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a",
          "url": "https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a"
        },
        {
          "category": "external",
          "summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9",
          "url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9"
        },
        {
          "category": "external",
          "summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8",
          "url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8"
        },
        {
          "category": "external",
          "summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735",
          "url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735"
        }
      ],
      "release_date": "2026-07-08T15:47:24.885000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T08:18:40+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85846"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications should implement input validation to reject or clamp any externally supplied List index or key-path segment that exceeds a sane maximum, specifically values greater than or equal to 2^30. Additionally, running request handling in isolated worker processes with capped heap sizes (e.g., using `--max-old-space-size`) can contain the impact of a potential process abort.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations"
    },
    {
      "cve": "CVE-2026-69153",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-08-03T18:01:01.506065+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the \u0027from\u0027 parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application\u0027s source code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this flaw as Moderate because the information disclosed is limited to files with a .map extension. Source map files may contain source code paths and content, but the attacker cannot read arbitrary files on the system. Exploitation requires the application to process attacker-controlled CSS through PostCSS on the server side.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8",
          "url": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/releases/tag/8.5.19",
          "url": "https://github.com/postcss/postcss/releases/tag/8.5.19"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp",
          "url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
        }
      ],
      "release_date": "2026-08-03T16:56:25.733000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T08:18:40+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85846"
        },
        {
          "category": "workaround",
          "details": "Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL"
    },
    {
      "cve": "CVE-2026-84445",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-09-14T16:22:17.356407+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533175"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer() can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a Denial of Service (DoS). In some deployments, this attack can be unauthenticated.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533175",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533175"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84445",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84445",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7",
          "url": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4",
          "url": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f",
          "url": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/issues/9354",
          "url": "https://github.com/grpc/grpc-go/issues/9354"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/pull/9365",
          "url": "https://github.com/grpc/grpc-go/pull/9365"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/pull/9366",
          "url": "https://github.com/grpc/grpc-go/pull/9366"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/pull/9367",
          "url": "https://github.com/grpc/grpc-go/pull/9367"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2",
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2",
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj",
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"
        }
      ],
      "release_date": "2026-09-14T16:11:41.401000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T08:18:40+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85846"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests"
    },
    {
      "cve": "CVE-2026-87776",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-09-11T11:40:59.000487+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531852"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `compression` Node.js and Express middleware. A remote unauthenticated attacker can exploit this vulnerability by repeatedly initiating and then prematurely aborting connections while compressed responses are being sent. This action prevents the zlib stream, used for compression, from being properly destroyed, leading to a memory leak. Over time, this memory exhaustion can cause the server to crash, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "compression: compression: Denial of Service via memory leak on premature response close",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has rated this vulnerability as Important. A remote unauthenticated attacker can cause a denial of service by repeatedly aborting connections while compressed responses are being sent, which can lead to memory exhaustion and server termination.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-87776"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531852",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531852"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-87776",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-87776"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87776",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87776"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95",
          "url": "https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95"
        }
      ],
      "release_date": "2026-09-11T11:24:55.150000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T08:18:40+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85846"
        },
        {
          "category": "workaround",
          "details": "Update the compression middleware to version 1.8.2 or later. No supported workaround is currently available if the affected version cannot be updated.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "compression: compression: Denial of Service via memory leak on premature response close"
    },
    {
      "cve": "CVE-2026-88031",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-09-10T18:11:27.321656+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531587"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in go.mongodb.org/mongo-driver for version \u003c 1.17.10 and \u003c 2.9.1. \nImproper handling of data query elements in the GridFS component can lead to a file identifier being misinterpreted as a query. An authenticated user can exploit this to delete all GridFS file chunks, making stored file content unreadable, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the MongoDB Go Driver. The GridFS component does not properly sanitize caller-supplied file identifiers before using them in database queries. A structured document passed as a file ID (for example, a BSON document containing query operators) is interpreted as a query condition rather than a literal match value. An authenticated attacker who can influence the file identifier passed to GridFS operations such as Delete, DownloadToStream, or OpenDownloadStream in an affected application can exploit this to delete all chunks in a GridFS bucket, resulting in permanent data loss and denial of service.\nThe practical impact depends on whether the product\u0027s code passes externally-controlled values as GridFS file identifiers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-88031"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531587",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531587"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-88031",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-88031"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88031",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88031"
        },
        {
          "category": "external",
          "summary": "https://jira.mongodb.org/browse/GODRIVER-4081",
          "url": "https://jira.mongodb.org/browse/GODRIVER-4081"
        },
        {
          "category": "external",
          "summary": "https://www.mongodb.com/community/forums/t/mongodb-go-driver-1-17-10-released/343342",
          "url": "https://www.mongodb.com/community/forums/t/mongodb-go-driver-1-17-10-released/343342"
        }
      ],
      "release_date": "2026-09-10T17:59:35.845000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T08:18:40+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85846"
        },
        {
          "category": "workaround",
          "details": "If upgrading go.mongodb.org/mongo-driver to version 1.17.10 (v1) or 2.9.1 (v2) is not immediately possible, the following steps can reduce exposure:\n- Validate file identifiers before passing them to GridFS operations. Ensure that file IDs supplied by users or external systems are scalar values (e.g., primitive.ObjectID or string) and reject any structured BSON documents or maps. This prevents query operator injection.\n- Restrict who can supply GridFS file identifiers. Do not allow unauthenticated or low-privilege users to directly control the file ID parameter in GridFS API calls (Delete, OpenDownloadStream, DownloadToStream, etc.).",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs"
    },
    {
      "cve": "CVE-2026-90711",
      "cwe": {
        "id": "CWE-290",
        "name": "Authentication Bypass by Spoofing"
      },
      "discovery_date": "2026-09-15T06:41:11.029083+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533602"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this vulnerability by submitting a forged X-Forwarded-For header to spoof their client IP address. This flaw allows attackers to bypass IP-based access controls, rate limiting, and audit logging.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because unauthenticated remote attackers can spoof client IP addresses and circumvent security controls, such as rate limits or network access lists, by sending custom forwarding headers. Exploitation is contingent on application configurations that define reverse proxy trust subnets using IPv4-mapped IPv6 notation with short IPv4 prefix lengths. Environments configuring trusted proxies via canonical IPv4 CIDR blocks, hostnames, or default loopback addresses are not vulnerable to this behavior.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-90711"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533602",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533602"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-90711",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-90711"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90711",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90711"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h",
          "url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h"
        }
      ],
      "release_date": "2026-09-15T06:19:46.332000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T08:18:40+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85846"
        },
        {
          "category": "workaround",
          "details": "To mitigate this flaw through configuration:\n\n1. Configure trusted proxy definitions using standard IPv4 notation (such as `10.0.0.0/8`) rather than IPv4-mapped IPv6 notation.\n2. If IPv4-mapped IPv6 notation is required, set the subnet prefix length to at least 97 to cover the mapped boundary (for example, specify `::ffff:10.0.0.0/104` instead of `::ffff:10.0.0.0/8`).\n3. Alternatively, sanitize or strip incoming `X-Forwarded-For` headers at edge load balancers or boundary reverse proxies before passing traffic to backend applications.\n\nWarning: Modifying application configuration files requires restarting the Node.js application service, which will temporarily interrupt service availability and active connections.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet"
    },
    {
      "cve": "CVE-2026-92599",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-09-22T18:14:09.954827+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2538354"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in joi. A remote attacker can exploit an unanchored regular expression in the `Joi.string().isoDate()` validation rule by supplying a specially crafted string. This input, consisting of a valid ISO date followed by a long sequence of fractional-second digits, causes the regular expression engine to consume excessive processing time. This vulnerability leads to a Regular Expression Denial of Service (ReDoS), allowing the attacker to stall the application with a single request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "joi: joi: Denial of Service via `isoDate` validation regular expression",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability as it can be exploited remotely without authentication. An unanchored regular expression in the `isoDate` validation rule of the `joi` library allows an attacker to provide a crafted input, leading to excessive resource consumption and application unresponsiveness. This can significantly impact the availability of services utilizing the vulnerable `joi` versions for ISO date validation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92599"
        },
        {
          "category": "external",
          "summary": "RHBZ#2538354",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538354"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92599",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92599"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92599",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92599"
        },
        {
          "category": "external",
          "summary": "https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq",
          "url": "https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate",
          "url": "https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate"
        }
      ],
      "release_date": "2026-09-16T21:47:03.073000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T08:18:40+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85846"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, ensure that any input strings processed by the `Joi.string().isoDate()` validation rule are capped in length before being passed to the \u0027joi\u0027 package. This can prevent the regular expression engine from consuming excessive resources and causing a denial of service.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "joi: joi: Denial of Service via `isoDate` validation regular expression"
    },
    {
      "cve": "CVE-2026-93749",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "discovery_date": "2026-09-22T18:17:34.349880+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2538368"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in source-map-js. This vulnerability allows a remote attacker to trigger a denial of service by providing malformed input. Specifically, by supplying extremely large offset line values in indexed source maps, the attacker can cause the service\u0027s event loop to block, making it unable to process further requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "source-map-js: source-map-js: Denial of Service via malformed indexed source maps",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because an unauthenticated remote attacker can supply crafted data that synchronously blocks the single-threaded event loop, resulting in a sustained denial of service for affected services. In standard Red Hat application environments, source map parsing utilities are predominantly utilized in build systems or developer tooling rather than production-facing services, which limits general exposure. However, server-side applications accepting and processing untrusted source maps from external clients are directly susceptible to availability disruption.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
        ],
        "known_not_affected": [
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
          "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93749"
        },
        {
          "category": "external",
          "summary": "RHBZ#2538368",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538368"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93749",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93749"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93749",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93749"
        },
        {
          "category": "external",
          "summary": "https://github.com/7rulnik/source-map-js",
          "url": "https://github.com/7rulnik/source-map-js"
        },
        {
          "category": "external",
          "summary": "https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118",
          "url": "https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118"
        },
        {
          "category": "external",
          "summary": "https://github.com/7rulnik/source-map-js/issues/76",
          "url": "https://github.com/7rulnik/source-map-js/issues/76"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service",
          "url": "https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service"
        }
      ],
      "release_date": "2026-09-18T17:51:34.972000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T08:18:40+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85846"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64",
            "Red Hat Migration Toolkit 1.8:registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "source-map-js: source-map-js: Denial of Service via malformed indexed source maps"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.