RHSA-2026:94802
Vulnerability from csaf_redhat - Published: 2026-11-04 00:36 - Updated: 2026-11-06 07:51Summary
Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage
Severity
Critical
Notes
Topic: A Subscription Management tool for finding and reporting Red Hat product usage
Details: Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds,
identifies, and reports environment data, or facts, such as the number of physical and virtual
systems on a network, their operating systems, and relevant configuration data stored within
them. Discovery also identifies and reports more detailed facts for some versions of key
Red Hat packages and products that it finds in the network.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security (mTLS) settings, particularly those for client certificates, should have prevented such reuse. This issue could lead to a security feature bypass, where a client might use a connection with an unintended or weaker security configuration, potentially compromising the integrity or confidentiality of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link (a reference pointing to another location). This can lead to unauthorized deletion or alteration of files outside the temporary directory, performed with the privileges of the process executing the cleanup.
6.3 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8932
Threats
Impact
Moderate
A flaw was found in Python. A remote, unauthenticated TLS client can cause a use-after-free in a server that uses SSLContext.sni_callback to assign a different SSLSocket.context when selecting a certificate per server name, if nothing else keeps the original SSLContext alive. This can crash the server process or result in a call through a freed pointer. Servers that wrap their listening socket with a long-lived SSLContext are not affected. TLS clients are not affected.
8.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8932
Threats
Impact
Important
A flaw was found in Python. When establishing secure connections using the SSLContext.wrap_bio() function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rather than triggering an error. A remote man-in-the-middle attacker could exploit this defect to spoof trusted endpoints and intercept or tamper with sensitive encrypted traffic.
7.4 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8932
Threats
Impact
Important
A flaw was found in XZ Utils. When the `lzma_index_decoder()` function processes an empty index, and a subsequent `lzma_index_append()` operation is performed, insufficient memory is allocated. This can lead to a buffer overflow, potentially causing a denial of service (DoS) for affected systems.
5.3 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8932
Threats
Impact
Moderate
A flaw was found in OpenSSH. The internal-sftp component within sshd incorrectly processes command-line arguments, recognizing only the first nine. This limitation can prevent the application of intended security configurations for SFTP (SSH File Transfer Protocol) connections, potentially leading to a bypass of security properties.
5.4 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in OpenSSH. The sshd component has an undocumented security-relevant behavior where GSSAPIStrictAcceptorCheck has no value when the server is in a Windows Active Directory environment. This could lead to unintended information disclosure and impact data integrity.
6.5 (Medium)
Affected products
Fixed
2 products, the same list as for
CVE-2026-59997
Known not affected
2 products, the same list as for
CVE-2026-59997
Threats
Impact
Moderate
A flaw was found in OpenSSH's Secure Shell Daemon (sshd). This vulnerability allows a remote attacker to cause a denial of service by initiating an excessive number of authentication attempts. The issue arises from the mishandling of the MaxAuthTries setting specifically when using GSSAPIAuthentication, leading to resource exhaustion.
5.9 (Medium)
Affected products
Fixed
2 products, the same list as for
CVE-2026-59997
Known not affected
2 products, the same list as for
CVE-2026-59997
Threats
Impact
Moderate
A flaw was found in expat. A remote attacker can exploit this vulnerability through repeated parse buffer operations with unvalidated buffer lengths, causing a heap buffer over-read. This issue primarily leads to information disclosure by leaking adjacent heap memory contents, which could assist in bypassing security mitigations such as Address Space Layout Randomization (ASLR), or result in a Denial of Service (DoS) by crashing the application.
8.2 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8932
Threats
Impact
Important
A flaw was found in libX11. A heap-based buffer overflow vulnerability exists during the handling of XkbGetMap replies. A remote attacker, by operating a malicious X server, could exploit this flaw to potentially execute arbitrary code or cause a denial of service on the client system. User interaction is required for exploitation.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security (TLS) settings inadvertently overwrite the proxy's TLS configuration, which can disable certificate verification on reused connection contexts. Consequently, an attacker can impersonate the proxy to monitor or modify forwarded traffic or capture client credentials.
7.4 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-88806
Known not affected
2 products, the same list as for
CVE-2026-88806
Threats
Impact
Important
A flaw was found in urllib3. This flaw allows a Denial of Service (DoS) through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application.
7.5 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-88806
Known not affected
2 products, the same list as for
CVE-2026-88806
Threats
Impact
Important
A flaw was found in expat. On 32-bit systems, an integer overflow occurs within the expat_realloc memory allocation function when calculating buffer sizes. A remote attacker can exploit this vulnerability by supplying specially crafted XML input to an application that processes data with the library. Successful exploitation can lead to a Denial of Service (DoS) or memory corruption.
5.9 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8932
Threats
Impact
Moderate
A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or potentially arbitrary code execution.
8.1 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-88806
Known not affected
2 products, the same list as for
CVE-2026-88806
Threats
Exploit Status
CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Impact
Important
A flaw was found in Django REST framework. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by exhausting server memory. The issue occurs because the JSON parser accepts arbitrary client-supplied charset encodings, including decompression codecs, rather than restricting input to text encodings. By sending a crafted, compressed request, an attacker can bypass request size limits and trigger excessive memory allocation during parsing.
7.5 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-59997
Known not affected
2 products, the same list as for
CVE-2026-59997
Threats
Impact
Important
A flaw was found in Django REST Framework. When an application attempts to revoke authentication credentials using the TokenProxy component, the deletion query targets an incorrect identifier, causing the deletion to silently fail without raising an error. Consequently, revoked credentials remain active, allowing an unauthorized user to retain persistent access to protected application programming interfaces (APIs).
7.4 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-59997
Known not affected
2 products, the same list as for
CVE-2026-59997
Threats
Impact
Important
A flaw was found in djangorestframework. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending HTTP requests with a specially crafted Accept header containing an excessive number of media types with complex parameters. Because the framework performs unbounded and repetitive parsing of these header tokens across available renderers, processing such requests consumes disproportionate CPU resources. This can exhaust application worker processes and render the API service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-59997
Known not affected
2 products, the same list as for
CVE-2026-59997
Threats
Impact
Important
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
6.8 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2026-8932
Threats
Impact
Critical
A flaw was found in oauthlib. In certain token grant flows, the authorization system can authenticate an incoming client while retaining a different, client-supplied identifier for permission and scope validation. A remote, authenticated attacker with lower privileges can exploit this inconsistency by submitting another client's identifier during token requests. This flaw leads to privilege escalation, potentially allowing the attacker to obtain access tokens with unauthorized permissions and scopes associated with another client.
8.1 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-59997
Known not affected
2 products, the same list as for
CVE-2026-59997
Threats
Impact
Important
References
148 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A Subscription Management tool for finding and reporting Red Hat product usage",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds,\nidentifies, and reports environment data, or facts, such as the number of physical and virtual\nsystems on a network, their operating systems, and relevant configuration data stored within\nthem. Discovery also identifies and reports more detailed facts for some versions of key\nRed Hat packages and products that it finds in the network.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:94802",
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-102633",
"url": "https://access.redhat.com/security/cve/CVE-2026-102633"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-111497",
"url": "https://access.redhat.com/security/cve/CVE-2026-111497"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-114136",
"url": "https://access.redhat.com/security/cve/CVE-2026-114136"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-114137",
"url": "https://access.redhat.com/security/cve/CVE-2026-114137"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-114138",
"url": "https://access.redhat.com/security/cve/CVE-2026-114138"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-114406",
"url": "https://access.redhat.com/security/cve/CVE-2026-114406"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-118669",
"url": "https://access.redhat.com/security/cve/CVE-2026-118669"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-12345",
"url": "https://access.redhat.com/security/cve/CVE-2026-12345"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-19445",
"url": "https://access.redhat.com/security/cve/CVE-2026-19445"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-19553",
"url": "https://access.redhat.com/security/cve/CVE-2026-19553"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34743",
"url": "https://access.redhat.com/security/cve/CVE-2026-34743"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-59997",
"url": "https://access.redhat.com/security/cve/CVE-2026-59997"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-59998",
"url": "https://access.redhat.com/security/cve/CVE-2026-59998"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-60000",
"url": "https://access.redhat.com/security/cve/CVE-2026-60000"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-77214",
"url": "https://access.redhat.com/security/cve/CVE-2026-77214"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-88806",
"url": "https://access.redhat.com/security/cve/CVE-2026-88806"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-8932",
"url": "https://access.redhat.com/security/cve/CVE-2026-8932"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-97687",
"url": "https://access.redhat.com/security/cve/CVE-2026-97687"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-97689",
"url": "https://access.redhat.com/security/cve/CVE-2026-97689"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/subscription_central/1-latest/#Discovery",
"url": "https://docs.redhat.com/en/documentation/subscription_central/1-latest/#Discovery"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94802.json"
}
],
"title": "Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage",
"tracking": {
"current_release_date": "2026-11-06T07:51:04+00:00",
"generator": {
"date": "2026-11-06T07:51:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHSA-2026:94802",
"initial_release_date": "2026-11-04T00:36:55+00:00",
"revision_history": [
{
"date": "2026-11-04T00:36:55+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-04T00:37:01+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-06T07:51:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Discovery 2",
"product": {
"name": "Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:discovery:2::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Discovery"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"product": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"product_id": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-server-rhel9@sha256%3Aca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0?arch=amd64\u0026repository_url=registry.redhat.io/discovery/discovery-server-rhel9\u0026tag=1793734080"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64",
"product": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64",
"product_id": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-ui-rhel9@sha256%3A84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e?arch=amd64\u0026repository_url=registry.redhat.io/discovery/discovery-ui-rhel9\u0026tag=1793733716"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"product": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"product_id": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-server-rhel9@sha256%3Af61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73?arch=arm64\u0026repository_url=registry.redhat.io/discovery/discovery-server-rhel9\u0026tag=1793734080"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"product": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"product_id": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-ui-rhel9@sha256%3A2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0?arch=arm64\u0026repository_url=registry.redhat.io/discovery/discovery-ui-rhel9\u0026tag=1793733716"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64 as a component of Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64"
},
"product_reference": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"relates_to_product_reference": "Red Hat Discovery 2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64 as a component of Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
},
"product_reference": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"relates_to_product_reference": "Red Hat Discovery 2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64 as a component of Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64"
},
"product_reference": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"relates_to_product_reference": "Red Hat Discovery 2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64 as a component of Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
},
"product_reference": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64",
"relates_to_product_reference": "Red Hat Discovery 2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-8932",
"cwe": {
"id": "CWE-1025",
"name": "Comparison Using Wrong Factors"
},
"discovery_date": "2026-07-03T07:01:15.122562+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496759"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security (mTLS) settings, particularly those for client certificates, should have prevented such reuse. This issue could lead to a security feature bypass, where a client might use a connection with an unintended or weaker security configuration, potentially compromising the integrity or confidentiality of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important security feature bypass in libcurl where mTLS connection reuse may occur despite changes to client certificate settings. This could lead to applications using libcurl with mTLS to inadvertently use a less secure connection than intended, potentially compromising data confidentiality or integrity. This issue primarily affects applications that dynamically alter mTLS client certificate configurations and reuse connections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8932"
},
{
"category": "external",
"summary": "RHBZ#2496759",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496759"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8932",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8932"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8932",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8932"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8932.html",
"url": "https://curl.se/docs/CVE-2026-8932.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8932.json",
"url": "https://curl.se/docs/CVE-2026-8932.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3733910",
"url": "https://hackerone.com/reports/3733910"
}
],
"release_date": "2026-07-03T06:16:30.485000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse"
},
{
"cve": "CVE-2026-12345",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access"
},
"discovery_date": "2026-09-29T18:27:06.236761+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2543492"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link (a reference pointing to another location). This can lead to unauthorized deletion or alteration of files outside the temporary directory, performed with the privileges of the process executing the cleanup.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity rather than Important because successful exploitation requires local system access, existing permissions to manipulate the target directory structure, and winning a narrow timing window during deletion. In Red Hat Enterprise Linux environments, standard temporary directory creation restricts access to the executing user, significantly limiting exposure to unprivileged local attackers. Applications running with elevated privileges that operate on shared or world-writable directories are at risk of unintended target file removal or permission tampering.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12345"
},
{
"category": "external",
"summary": "RHBZ#2543492",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543492"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12345"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12345",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12345"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d",
"url": "https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/157579",
"url": "https://github.com/python/cpython/issues/157579"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/157580",
"url": "https://github.com/python/cpython/pull/157580"
}
],
"release_date": "2026-09-29T17:46:01.811000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure kernel symlink protection is enabled (active by default in RHEL) by verifying sysctl fs.protected_symlinks is set to 1. Additionally, restrict exposure on shared systems by setting the TMPDIR environment variable to a secure, user-private directory rather than a public shared path (e.g., export TMPDIR=/path/to/private_tmp).",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup"
},
{
"cve": "CVE-2026-19445",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-09-30T16:44:14.851300+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544138"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python. A remote, unauthenticated TLS client can cause a use-after-free in a server that uses SSLContext.sni_callback to assign a different SSLSocket.context when selecting a certificate per server name, if nothing else keeps the original SSLContext alive. This can crash the server process or result in a call through a freed pointer. Servers that wrap their listening socket with a long-lived SSLContext are not affected. TLS clients are not affected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: Use-after-free of a server-side SSLContext when sni_callback switches contexts",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Important. A remote unauthenticated client can trigger a server-side use-after-free when SNI callback code switches SSLSocket.context and drops the last reference to the original SSLContext, which can crash the process or call through a freed pointer (C:H/I:H/A:H). It is not Critical: exploitation requires a specific, non-default server pattern (per-connection or replaced SSLContext with sni_callback); the common pattern of wrapping the listening socket is explicitly not affected, so Attack Complexity is High. Red Hat ASLR, NX, and glibc heap hardening raise the bar for reliable code execution from the UAF but do not remove the crash/DoS impact, so Availability remains High.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19445"
},
{
"category": "external",
"summary": "RHBZ#2544138",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544138"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19445"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19445",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19445"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/156293",
"url": "https://github.com/python/cpython/issues/156293"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/158504",
"url": "https://github.com/python/cpython/pull/158504"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/"
}
],
"release_date": "2026-09-30T16:16:04.923000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
},
{
"category": "workaround",
"details": "Restrict Python TLS servers that use SSLContext.sni_callback to trusted clients. Keep a strong reference to every SSLContext that registers an SNI callback for the lifetime of the server so the original context cannot be garbage-collected while connections remain open. Prefer wrapping the listening socket with a long-lived SSLContext; that common pattern is not affected. Host heap allocator hardening increases the difficulty of turning the use-after-free into reliable code execution but does not prevent process crashes.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: Use-after-free of a server-side SSLContext when sni_callback switches contexts"
},
{
"cve": "CVE-2026-19553",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2026-09-30T16:41:50.203373+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544127"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python. When establishing secure connections using the SSLContext.wrap_bio() function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rather than triggering an error. A remote man-in-the-middle attacker could exploit this defect to spoof trusted endpoints and intercept or tamper with sensitive encrypted traffic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Important because a man-in-the-middle attacker can cause Python clients using SSLContext.wrap_bio() (or asyncio TLS helpers that call it) to skip certificate hostname verification when check_hostname is enabled but server_hostname is omitted or empty, compromising confidentiality and integrity of the TLS session (C:H/I:H). It is not Critical: exploitation requires an on-path attacker and that specific API misuse (AC:H).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19553"
},
{
"category": "external",
"summary": "RHBZ#2544127",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544127"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19553"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19553",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19553"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/156793",
"url": "https://github.com/python/cpython/issues/156793"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/158503",
"url": "https://github.com/python/cpython/pull/158503"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/"
}
],
"release_date": "2026-09-30T16:17:39.368000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
},
{
"category": "workaround",
"details": "Restrict Python TLS clients to trusted networks so an on-path attacker cannot intercept sessions. Applications that use SSLContext.wrap_bio(), asyncio.create_connection(), or loop.start_tls() with check_hostname enabled must pass a non-empty server_hostname; hostname verification then proceeds and this flaw is not reachable. Optionally pin expected server certificates so a mismatched host certificate is rejected even if hostname checking is skipped.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()"
},
{
"cve": "CVE-2026-34743",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-02T19:02:56.599601+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2454589"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in XZ Utils. When the `lzma_index_decoder()` function processes an empty index, and a subsequent `lzma_index_append()` operation is performed, insufficient memory is allocated. This can lead to a buffer overflow, potentially causing a denial of service (DoS) for affected systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "xz: XZ Utils: Denial of Service via buffer overflow in index decoding",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34743"
},
{
"category": "external",
"summary": "RHBZ#2454589",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454589"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34743",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34743"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34743",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34743"
},
{
"category": "external",
"summary": "https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87",
"url": "https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87"
},
{
"category": "external",
"summary": "https://github.com/tukaani-project/xz/releases/tag/v5.8.3",
"url": "https://github.com/tukaani-project/xz/releases/tag/v5.8.3"
},
{
"category": "external",
"summary": "https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv",
"url": "https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv"
}
],
"release_date": "2026-04-02T18:36:37.450000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "xz: XZ Utils: Denial of Service via buffer overflow in index decoding"
},
{
"cve": "CVE-2026-59997",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command"
},
"discovery_date": "2026-07-08T01:01:08.930287+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497929"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSH. The internal-sftp component within sshd incorrectly processes command-line arguments, recognizing only the first nine. This limitation can prevent the application of intended security configurations for SFTP (SSH File Transfer Protocol) connections, potentially leading to a bypass of security properties.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59997"
},
{
"category": "external",
"summary": "RHBZ#2497929",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497929"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59997",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59997"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59997",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59997"
},
{
"category": "external",
"summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
"url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
},
{
"category": "external",
"summary": "https://www.openssh.org/releasenotes.html#10.4p1",
"url": "https://www.openssh.org/releasenotes.html#10.4p1"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
"url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
}
],
"release_date": "2026-07-08T00:09:04.920000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that all security-relevant command-line arguments for the `internal-sftp` server are positioned within the first nine arguments. Alternatively, consider using the default SFTP server implementation if custom configurations relying on numerous arguments are not strictly necessary. If `internal-sftp` is used with more than nine arguments, verify that no critical security options are being silently discarded.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw"
},
{
"cve": "CVE-2026-59998",
"cwe": {
"id": "CWE-909",
"name": "Missing Initialization of Resource"
},
"discovery_date": "2026-07-08T01:01:30.478799+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497935"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSH. The sshd component has an undocumented security-relevant behavior where GSSAPIStrictAcceptorCheck has no value when the server is in a Windows Active Directory environment. This could lead to unintended information disclosure and impact data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59998"
},
{
"category": "external",
"summary": "RHBZ#2497935",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497935"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59998",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59998"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59998",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59998"
},
{
"category": "external",
"summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
"url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
},
{
"category": "external",
"summary": "https://www.openssh.org/releasenotes.html#10.4p1",
"url": "https://www.openssh.org/releasenotes.html#10.4p1"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
"url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
}
],
"release_date": "2026-07-08T00:11:05.183000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid using GSSAPI authentication for `sshd` when the server is integrated with a Windows Active Directory environment. If GSSAPI authentication is not strictly required, it can be disabled by setting `GSSAPIAuthentication no` in the `/etc/ssh/sshd_config` file. After modifying the configuration, the `sshd` service must be restarted for the changes to take effect. Note that restarting the `sshd` service will terminate all active SSH sessions.\n```bash\n# echo \"GSSAPIAuthentication no\" \u003e\u003e /etc/ssh/sshd_config\n# systemctl restart sshd\n```\nAlternatively, if GSSAPI authentication is necessary in such an environment, ensure that the network path between the client and the `sshd` server, and to the Active Directory, is secured and trusted to prevent man-in-the-middle attacks.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory"
},
{
"cve": "CVE-2026-60000",
"cwe": {
"id": "CWE-307",
"name": "Improper Restriction of Excessive Authentication Attempts"
},
"discovery_date": "2026-07-08T01:02:09.730221+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497946"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSH\u0027s Secure Shell Daemon (sshd). This vulnerability allows a remote attacker to cause a denial of service by initiating an excessive number of authentication attempts. The issue arises from the mishandling of the MaxAuthTries setting specifically when using GSSAPIAuthentication, leading to resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact denial of service flaw in OpenSSH\u0027s `sshd` daemon arises from improper handling of `MaxAuthTries` during GSSAPI authentication attempts. Exploitation requires `GSSAPIAuthentication` to be explicitly enabled, which is not the default configuration in Red Hat Enterprise Linux and other affected Red Hat products, thereby limiting the attack surface in typical deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-60000"
},
{
"category": "external",
"summary": "RHBZ#2497946",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497946"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-60000",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-60000"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-60000",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60000"
},
{
"category": "external",
"summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
"url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
},
{
"category": "external",
"summary": "https://www.openssh.org/releasenotes.html#10.4p1",
"url": "https://www.openssh.org/releasenotes.html#10.4p1"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
"url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
}
],
"release_date": "2026-07-08T00:14:31.230000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts"
},
{
"cve": "CVE-2026-77214",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-10-07T14:42:40.407146+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2547476"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in expat. A remote attacker can exploit this vulnerability through repeated parse buffer operations with unvalidated buffer lengths, causing a heap buffer over-read. This issue primarily leads to information disclosure by leaking adjacent heap memory contents, which could assist in bypassing security mitigations such as Address Space Layout Randomization (ASLR), or result in a Denial of Service (DoS) by crashing the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because the Expat XML parser is ubiquitous across Red Hat Enterprise Linux environments, frequently handling untrusted inputs in network-facing services and runtime environments. When applications process incoming XML data through repeated chunked parsing calls, an unauthenticated attacker can induce an out-of-bounds heap read without requiring prior privileges. This memory disclosure enables the retrieval of process memory layouts and pointers, effectively weakening ASLR and lowering the barrier for subsequent exploit chains.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-77214"
},
{
"category": "external",
"summary": "RHBZ#2547476",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547476"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-77214",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77214"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77214",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77214"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0",
"url": "https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/pull/1393",
"url": "https://github.com/libexpat/libexpat/pull/1393"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer",
"url": "https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer"
}
],
"release_date": "2026-10-07T14:35:42.794000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer"
},
{
"cve": "CVE-2026-88806",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-22T18:47:16.244674+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2538514"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libX11. A heap-based buffer overflow vulnerability exists during the handling of XkbGetMap replies. A remote attacker, by operating a malicious X server, could exploit this flaw to potentially execute arbitrary code or cause a denial of service on the client system. User interaction is required for exploitation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libX11: libX11: Heap-based buffer overflow via malicious X server",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this vulnerability as Important because an attacker operating a rogue or compromised X server can trigger memory corruption, potentially leading to arbitrary code execution with the permissions of the connecting client application. In typical Red Hat Enterprise Linux deployments, graphical applications communicate over trusted local sockets to the local display server, substantially restricting attack vectors. However, risk increases in scenarios where users connect to untrusted remote displays or employ unverified remote X11 session forwarding.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-88806"
},
{
"category": "external",
"summary": "RHBZ#2538514",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538514"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-88806",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-88806"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88806",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88806"
},
{
"category": "external",
"summary": "https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309",
"url": "https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309"
}
],
"release_date": "2026-09-21T13:42:12.700000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should avoid connecting to untrusted X servers. When using SSH, ensure that X11 forwarding (`ssh -X` or `ssh -Y`) is only enabled for trusted remote hosts. To prevent X11 forwarding for specific hosts, add `ForwardX11 no` to the relevant host entry in `~/.ssh/config` or `/etc/ssh/ssh_config`. Alternatively, disable X11 forwarding globally by setting `ForwardX11 no` in `/etc/ssh/ssh_config`.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libX11: libX11: Heap-based buffer overflow via malicious X server"
},
{
"cve": "CVE-2026-97687",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-09-29T15:44:25.449046+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2543255"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security (TLS) settings inadvertently overwrite the proxy\u0027s TLS configuration, which can disable certificate verification on reused connection contexts. Consequently, an attacker can impersonate the proxy to monitor or modify forwarded traffic or capture client credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has evaluated this vulnerability as having an Important impact because a network attacker can exploit corrupted TLS validation states to impersonate an HTTPS proxy, enabling complete interception and manipulation of sensitive communications as well as client credential theft. Successful exploitation depends on specialized application architectures where outgoing requests utilize an HTTPS-capable proxy alongside customized destination TLS parameters that inadvertently override proxy verification. Default Red Hat enterprise deployments that communicate directly with endpoints, utilize traditional HTTP proxies, or rely on standard CONNECT tunneling for end-to-end encryption do not expose this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97687"
},
{
"category": "external",
"summary": "RHBZ#2543255",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543255"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97687",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97687"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97687",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97687"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465",
"url": "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3",
"url": "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/pull/5093",
"url": "https://github.com/urllib3/urllib3/pull/5093"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/releases/tag/2.8.0",
"url": "https://github.com/urllib3/urllib3/releases/tag/2.8.0"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"
}
],
"release_date": "2026-09-29T15:30:27.136000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override"
},
{
"cve": "CVE-2026-97689",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-29T15:41:38.807723+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2543245"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3. This flaw allows a Denial of Service (DoS) through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact because an untrusted remote server can trigger process crashes and complete denial of service across client applications without requiring authentication or special privileges. In Red Hat environments, urllib3 is integrated across numerous system tools, container workloads, and platform services to handle outbound web communication. The risk specifically manifests when these services process streamed replies from potentially malicious third-party endpoints, whereas workloads restricted to internal or verified infrastructure remain largely unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97689"
},
{
"category": "external",
"summary": "RHBZ#2543245",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543245"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97689",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97689"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97689",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97689"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed",
"url": "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/releases/tag/2.8.0",
"url": "https://github.com/urllib3/urllib3/releases/tag/2.8.0"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw"
}
],
"release_date": "2026-09-29T15:36:05.963000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser"
},
{
"cve": "CVE-2026-102633",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-09-29T16:31:19.583045+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2543288"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in expat. On 32-bit systems, an integer overflow occurs within the expat_realloc memory allocation function when calculating buffer sizes. A remote attacker can exploit this vulnerability by supplying specially crafted XML input to an application that processes data with the library. Successful exploitation can lead to a Denial of Service (DoS) or memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "expat: expat: Denial of Service via integer overflow in expat_realloc",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw of moderate impact was found in the expat XML parser library (libexpat), which is shipped in Red Hat Enterprise Linux and Fedora. On 32-bit systems, an integer overflow can occur in the expat_realloc() memory allocation function when buffer sizes are calculated, resulting in an undersized heap allocation that can lead to a heap buffer overflow, memory corruption, or a crash. A remote attacker can supply specially crafted XML input to an application that processes data with the vulnerable library, causing a denial of service of that application; no privileges or user interaction are required, but exploitation is limited to 32-bit platforms and requires triggering specific allocation sizes, so attack complexity is high.\n\nRed Hat Product Security rates this flaw Moderate (CVSS 3.1 score 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), which differs from the upstream CVSS 4.0 rating of Important (8.2) because the vulnerability is restricted to 32-bit architectures with high attack complexity and its impact is limited to availability.\n\nAffected expat and mingw-expat components span Red Hat Enterprise Linux 6 through 10, Red Hat In-Vehicle OS, Red Hat Hardened Images, and Fedora. For Red Hat Enterprise Linux and UBI-related streams, fixes are being pursued through delegated updates. For several maintenance streams the fix is deferred because the flaw is Moderate severity with a CVSS score below 7.0, leaving a residual risk of denial of service or memory corruption on 32-bit deployments until a fix is delivered. Red Hat Enterprise Linux 6 and certain platform streams are out of support scope and will not be fixed. The expat package in Red Hat Hardened Images (Hummingbird) is not affected because the vulnerable code is not present.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102633"
},
{
"category": "external",
"summary": "RHBZ#2543288",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543288"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102633",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102633"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102633",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102633"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat",
"url": "https://github.com/libexpat/libexpat"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003",
"url": "https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118",
"url": "https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/pull/1392",
"url": "https://github.com/libexpat/libexpat/pull/1392"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc",
"url": "https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc"
}
],
"release_date": "2026-09-29T16:04:16.738000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "expat: expat: Denial of Service via integer overflow in expat_realloc"
},
{
"cve": "CVE-2026-111497",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-22T13:42:58.596140+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2558973"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or potentially arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brotli: Out-of-Bounds Write in Google Brotli Decoder",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Important. Exploitation requires that the target decompress attacker-controlled Brotli data (for example HTTP content negotiated with Content-Encoding: br, or APIs such as Node.js zlib / fetch() that decode Brotli). The vulnerable path is reached with a malformed stream rather than typical well-formed encoder output. Red Hat Enterprise Linux compiler and runtime hardenings - including Address Space Layout Randomization (ASLR), Non-eXecutable (NX) memory, FORTIFY_SOURCE, and SELinux - increase the difficulty of turning this memory corruption into reliable code execution, though they do not eliminate crashes or all impact. Combined with the Attack Requirements noted by the CNA (CVSS v4 AT:P), Red Hat scores Attack Complexity as High and rates the flaw Important rather than Critical.\n\n---\n\nThe Node.js packages in Red Hat Enterprise Linux use either system version of brotli or bundled version. Some Node.js versions are marked \"Not affected\" because they utilize system brotli. For these versions, the Node.js package itself does not require updating. However, customers must still update the system brotli/libbrotli package to address the vulnerability for these Node.js installations.\n\nFollowing is the overview of Node.js versions use system or bundled version.\n\n- Node.js 22 in Red Hat Enterprise Linux 8 and 9, provided via nodejs:22 module, uses system brotli.\n- Node.js 24 in Red Hat Enterprise Linux 8 and 9, provided via nodejs:24 modules, use bundled brotli.\n- Node.js 22 and 24 in Red Hat Enterprise Linux 10, provided via nodejs22 and nodejs24 use system brotli.\n\n---\n\nThe .NET packages in Red Hat Enterprise Linux may either use system version of brotli or bundled version. Following is the overview of .NET versions use system or bundled version.\n\n- .NET 8.0 in Red Hat Enterprise Linux 8, 9, and 10, provided via dotnet8.0 packages, use bundled brotli.\n- .NET 9.0, 10.0, and 11.0 in Red Hat Enterprise Linux 8, 9, and 10, provided via dotnet9.0, dotnet10.0, and dotnet11.0 packages, use system brotli.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-111497"
},
{
"category": "external",
"summary": "RHBZ#2558973",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558973"
},
{
"category": "external",
"summary": "RHSB-2026-015",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-111497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111497"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high",
"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"
},
{
"category": "external",
"summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"release_date": "2026-10-22T13:35:41.975000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
},
{
"category": "workaround",
"details": "See the security bulletin for a detailed mitigation procedure.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "exploit_status",
"date": "2026-10-27T00:00:00+00:00",
"details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"category": "impact",
"details": "Important"
}
],
"title": "brotli: Out-of-Bounds Write in Google Brotli Decoder"
},
{
"cve": "CVE-2026-114136",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-10-21T20:11:11.665764+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2558525"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Django REST framework. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by exhausting server memory. The issue occurs because the JSON parser accepts arbitrary client-supplied charset encodings, including decompression codecs, rather than restricting input to text encodings. By sending a crafted, compressed request, an attacker can bypass request size limits and trigger excessive memory allocation during parsing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because remote, unauthenticated attackers can cause severe worker process memory exhaustion on exposed endpoints without requiring privileges or user interaction. While the impact is restricted to service availability rather than data confidentiality or integrity, the massive amplification ratio allows small network payloads to evade framework request-size constraints. In Red Hat environments, affected management and automation services rely on default API parser configurations, making backend workers susceptible to denial of service from minimal malicious traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-114136"
},
{
"category": "external",
"summary": "RHBZ#2558525",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558525"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-114136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-114136"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114136",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114136"
},
{
"category": "external",
"summary": "https://github.com/encode/django-rest-framework/commit/3c2634599b26a9f789b03045118dbc276117611a",
"url": "https://github.com/encode/django-rest-framework/commit/3c2634599b26a9f789b03045118dbc276117611a"
},
{
"category": "external",
"summary": "https://github.com/encode/django-rest-framework/releases/tag/3.18.2",
"url": "https://github.com/encode/django-rest-framework/releases/tag/3.18.2"
},
{
"category": "external",
"summary": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-3547-9m27-7rxg",
"url": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-3547-9m27-7rxg"
}
],
"release_date": "2026-10-21T20:02:41.030000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser"
},
{
"cve": "CVE-2026-114137",
"cwe": {
"id": "CWE-613",
"name": "DEPRECATED: Insufficient Session Expiration"
},
"discovery_date": "2026-10-21T20:33:02.935407+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2558557"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Django REST Framework. When an application attempts to revoke authentication credentials using the TokenProxy component, the deletion query targets an incorrect identifier, causing the deletion to silently fail without raising an error. Consequently, revoked credentials remain active, allowing an unauthorized user to retain persistent access to protected application programming interfaces (APIs).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "djangorestframework: djangorestframework: Unauthorized access via improper token revocation in TokenProxy",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this vulnerability as having an Important severity because incomplete credential invalidation directly compromises API authorization boundaries, allowing decommissioned or compromised credentials to maintain persistent remote access across exposed endpoints. Within Red Hat environments like Ansible Automation Platform and Satellite, backend services depend on API tokens for routine orchestration and integration workflows. While built-in administration interfaces that bypass proxy-based deletion remain unaffected, automated workflows and external tooling attempting credential revocation silently fail to purge access, leaving tokens valid indefinitely.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-114137"
},
{
"category": "external",
"summary": "RHBZ#2558557",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558557"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-114137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-114137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114137"
},
{
"category": "external",
"summary": "https://github.com/encode/django-rest-framework/commit/af3fabfd517307fbc5d500fba1ab8f6e25f220b0",
"url": "https://github.com/encode/django-rest-framework/commit/af3fabfd517307fbc5d500fba1ab8f6e25f220b0"
},
{
"category": "external",
"summary": "https://github.com/encode/django-rest-framework/releases/tag/3.18.2",
"url": "https://github.com/encode/django-rest-framework/releases/tag/3.18.2"
},
{
"category": "external",
"summary": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-xw6w-gcfp-cf8m",
"url": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-xw6w-gcfp-cf8m"
}
],
"release_date": "2026-10-21T20:06:57.790000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "djangorestframework: djangorestframework: Unauthorized access via improper token revocation in TokenProxy"
},
{
"cve": "CVE-2026-114138",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-21T20:31:23.246015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2558553"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in djangorestframework. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending HTTP requests with a specially crafted Accept header containing an excessive number of media types with complex parameters. Because the framework performs unbounded and repetitive parsing of these header tokens across available renderers, processing such requests consumes disproportionate CPU resources. This can exhaust application worker processes and render the API service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an unauthenticated remote user can force severe CPU exhaustion and service outages across exposed web endpoints without requiring valid credentials. In Red Hat environments, products such as Red Hat Ansible Automation Platform and Satellite deploy web APIs that rely on synchronous application workers, making them susceptible to worker starvation when handling excessive content negotiation headers. Although active exploitation can render exposed API services temporarily unavailable, the vulnerability does not compromise system integrity or expose sensitive data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-114138"
},
{
"category": "external",
"summary": "RHBZ#2558553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-114138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-114138"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114138",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114138"
},
{
"category": "external",
"summary": "https://github.com/encode/django-rest-framework/commit/148ab6523922d5a0c110f76615935e5220b63029",
"url": "https://github.com/encode/django-rest-framework/commit/148ab6523922d5a0c110f76615935e5220b63029"
},
{
"category": "external",
"summary": "https://github.com/encode/django-rest-framework/releases/tag/3.18.2",
"url": "https://github.com/encode/django-rest-framework/releases/tag/3.18.2"
},
{
"category": "external",
"summary": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-33wh-fxxf-88vv",
"url": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-33wh-fxxf-88vv"
}
],
"release_date": "2026-10-21T20:09:06.489000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing"
},
{
"cve": "CVE-2026-114406",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-20T09:01:55.916000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556046"
}
],
"notes": [
{
"category": "description",
"text": "The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.\n\nDue to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This CVE has been assigned to track trust store updates to distrust compromised certificates, but is not a vulnerability. For details, see RHSB-2026-012.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-114406"
},
{
"category": "external",
"summary": "RHBZ#2556046",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556046"
},
{
"category": "external",
"summary": "RHSB-2026-012",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-114406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-114406"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114406",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114406"
}
],
"release_date": "2026-10-20T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
},
{
"category": "workaround",
"details": "See the security bulletin for a detailed mitigation procedure.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns"
},
{
"cve": "CVE-2026-118669",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-10-28T21:22:24.906349+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2563201"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in oauthlib. In certain token grant flows, the authorization system can authenticate an incoming client while retaining a different, client-supplied identifier for permission and scope validation. A remote, authenticated attacker with lower privileges can exploit this inconsistency by submitting another client\u0027s identifier during token requests. This flaw leads to privilege escalation, potentially allowing the attacker to obtain access tokens with unauthorized permissions and scopes associated with another client.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity for Red Hat products because an authenticated client with low privileges can obtain access tokens under a different identity over the network, leading to significant privilege escalation without requiring user interaction. The exposure specifically impacts deployments where the server application relies on the submitted client identifier parameter during scope or grant checks instead of the authenticated client object. Workloads that do not act as an OAuth2 token endpoint or that enforce scope authorization solely from the authenticated entity remain unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-118669"
},
{
"category": "external",
"summary": "RHBZ#2563201",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563201"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-118669",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118669"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-118669",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118669"
},
{
"category": "external",
"summary": "https://github.com/oauthlib/oauthlib/commit/c951a1d09f99f14e3240973fa83c4f4287d4753d",
"url": "https://github.com/oauthlib/oauthlib/commit/c951a1d09f99f14e3240973fa83c4f4287d4753d"
},
{
"category": "external",
"summary": "https://github.com/oauthlib/oauthlib/pull/920",
"url": "https://github.com/oauthlib/oauthlib/pull/920"
},
{
"category": "external",
"summary": "https://github.com/oauthlib/oauthlib/releases/tag/v4.0.0",
"url": "https://github.com/oauthlib/oauthlib/releases/tag/v4.0.0"
},
{
"category": "external",
"summary": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-7984-qgvg-3j9c",
"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-7984-qgvg-3j9c"
}
],
"release_date": "2026-10-28T21:09:58.893000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T00:36:55+00:00",
"details": "The containers required to run Discovery can be installed through discoveryctl\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94802"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ca92ccbc631ef611a3bdb41ce782955ec386ebe150a8cdaefadc1237f6b79ba0_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f61cac028ee7bb6606b6baad72ed5018bf80622422308279d27669c259de5d73_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2348157c3e6fbea084390c0bee502b8efecad3387b97cdca790e8ee725b93ce0_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:84419ba38b148dfd0faf60bc6a604f1cb85878854520bf59f0514acc6e0fb49e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.