RHSA-2026:95124
Vulnerability from csaf_redhat - Published: 2026-11-04 13:07 - Updated: 2026-11-06 11:06Summary
Red Hat Security Advisory: RHTAS 1.5.1 - Red Hat Trusted Artifact Signer Release
Severity
Important
Notes
Topic: The 1.5.1 release of Red Hat Trusted Artifact Signer OpenShift Operator.
For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5
Details: The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20, 4.21, 4.22, 5.0
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in undici. A remote server can cause a Denial of Service (DoS) by initiating a Transport Layer Security (TLS) renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught assertion is triggered, terminating the client process and disrupting active network requests.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-19534
Known not affected
1 product, the same list as for
CVE-2026-19534
Threats
Impact
Important
A flaw was found in undici. A remote malicious or compromised HTTP server can cause a Denial of Service (DoS) by sending a small compressed response that decompresses beyond configured size limits. Because undici fails to catch errors triggered by response handlers during decompression, an unhandled exception is produced that crashes the client application.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-19534
Known not affected
1 product, the same list as for
CVE-2026-19534
Threats
Impact
Moderate
A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security (TLS) verification functions during internal configuration copying, causing the client to silently ignore application-specific checks such as certificate or public-key pinning.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-19534
Known not affected
1 product, the same list as for
CVE-2026-19534
Threats
Impact
Important
A flaw was found in undici. When an application configures redirect handling alongside a shared cache, responses received after cross-origin redirects are incorrectly stored under the initial request URL. A remote attacker who controls a redirect destination can exploit this vulnerability to poison the shared cache, serving malicious content to subsequent users requesting trusted URLs. Additionally, this behavior can result in information disclosure if private or user-specific responses are cached and delivered to unauthorized callers.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-19534
Known not affected
1 product, the same list as for
CVE-2026-19534
Threats
Impact
Important
A flaw was found in undici. The HTTP client improperly handles case sensitivity when verifying Subresource Integrity (SRI) algorithm tokens. When an application specifies an uppercase or mixed-case algorithm name, undici treats the token as unrecognized and skips verification instead of enforcing it. A remote attacker who controls the HTTP response body can exploit this flaw to deliver modified content without triggering an integrity error, bypassing intended security protections.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-19534
Known not affected
1 product, the same list as for
CVE-2026-19534
Threats
Impact
Moderate
A flaw was found in undici. When an application sends a request to a malicious remote server, the server can return a response with excessive content encodings and immediately close the connection. Because the underlying response stream is left unhandled, this abrupt closure triggers an unhandled error that causes the application process to crash. Consequently, an attacker operating a remote server can cause a Denial of Service (DoS), terminating the application even if standard error handling is implemented.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-19534
Known not affected
1 product, the same list as for
CVE-2026-19534
Threats
Impact
Important
A flaw was found in undici. A malicious server can trigger a Denial of Service (DoS) by exhausting application memory. When an application connects to an untrusted Server-Sent Events (SSE) feed, the EventSource parser does not properly limit retained internal state when processing fragmented lines or repeated message fields. This allows an attacker to send crafted or compressed responses that consume excessive memory and terminate the application process.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-19534
Known not affected
1 product, the same list as for
CVE-2026-19534
Threats
Impact
Moderate
A flaw was found in undici. A malicious or compromised WebSocket server can trigger a Denial of Service (DoS) by repeatedly sending small PING messages while refusing to read the client's automated replies. Because the client ignores flow-control signals when writing responses to the network socket, unread messages accumulate indefinitely in memory. This unchecked memory consumption can exhaust available system memory and cause the application process to terminate.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-19534
Known not affected
1 product, the same list as for
CVE-2026-19534
Threats
Impact
Moderate
References
74 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "The 1.5.1 release of Red Hat Trusted Artifact Signer OpenShift Operator.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5",
"title": "Topic"
},
{
"category": "general",
"text": "The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20, 4.21, 4.22, 5.0",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:95124",
"url": "https://access.redhat.com/errata/RHSA-2026:95124"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-109383",
"url": "https://access.redhat.com/security/cve/CVE-2026-109383"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-109829",
"url": "https://access.redhat.com/security/cve/CVE-2026-109829"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-109841",
"url": "https://access.redhat.com/security/cve/CVE-2026-109841"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-109869",
"url": "https://access.redhat.com/security/cve/CVE-2026-109869"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-109924",
"url": "https://access.redhat.com/security/cve/CVE-2026-109924"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-109932",
"url": "https://access.redhat.com/security/cve/CVE-2026-109932"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-19534",
"url": "https://access.redhat.com/security/cve/CVE-2026-19534"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33818",
"url": "https://access.redhat.com/security/cve/CVE-2026-33818"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-87018",
"url": "https://access.redhat.com/security/cve/CVE-2026-87018"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-87029",
"url": "https://access.redhat.com/security/cve/CVE-2026-87029"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95124.json"
}
],
"title": "Red Hat Security Advisory: RHTAS 1.5.1 - Red Hat Trusted Artifact Signer Release",
"tracking": {
"current_release_date": "2026-11-06T11:06:14+00:00",
"generator": {
"date": "2026-11-06T11:06:14+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.5"
}
},
"id": "RHSA-2026:95124",
"initial_release_date": "2026-11-04T13:07:48+00:00",
"revision_history": [
{
"date": "2026-11-04T13:07:48+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-04T13:07:55+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-06T11:06:14+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Trusted Artifact Signer 1.5",
"product": {
"name": "Red Hat Trusted Artifact Signer 1.5",
"product_id": "Red Hat Trusted Artifact Signer 1.5",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:trusted_artifact_signer:1.5::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Trusted Artifact Signer"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64",
"product": {
"name": "registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64",
"product_id": "registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/rhtas-console-ui-rhel9@sha256%3Aa64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/rhtas-console-ui-rhel9\u0026tag=1793114810"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64",
"product": {
"name": "registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64",
"product_id": "registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64",
"product_identification_helper": {
"purl": "pkg:oci/rhtas-console-rhel9@sha256%3A307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/rhtas-console-rhel9\u0026tag=1793108442"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64 as a component of Red Hat Trusted Artifact Signer 1.5",
"product_id": "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
},
"product_reference": "registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64 as a component of Red Hat Trusted Artifact Signer 1.5",
"product_id": "Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
},
"product_reference": "registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-19534",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-09-04T17:21:01.599799+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528759"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via unrequested WebSocket subprotocol",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in undici\u0027s WebSocket client, which can lead to a Node.js process crash. The vulnerability is triggered when an application connects to a malicious or compromised server that responds with an unrequested WebSocket subprotocol, allowing a remote, unauthenticated attacker to cause a denial of service in affected Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19534"
},
{
"category": "external",
"summary": "RHBZ#2528759",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528759"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19534"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19534",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19534"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5"
}
],
"release_date": "2026-09-04T17:10:05.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T13:07:48+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95124"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64",
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64",
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Denial of Service via unrequested WebSocket subprotocol"
},
{
"cve": "CVE-2026-33818",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs"
},
"discovery_date": "2026-08-13T22:12:37.151735+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33818"
},
{
"category": "external",
"summary": "RHBZ#2515815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33818"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818"
},
{
"category": "external",
"summary": "https://go.dev/cl/814980",
"url": "https://go.dev/cl/814980"
},
{
"category": "external",
"summary": "https://go.dev/issue/80405",
"url": "https://go.dev/issue/80405"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5972",
"url": "https://pkg.go.dev/vuln/GO-2026-5972"
}
],
"release_date": "2026-08-13T21:58:52.821000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T13:07:48+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95124"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64",
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64",
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
},
{
"cve": "CVE-2026-87018",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-10-15T18:45:26.683580+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553677"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A remote server can cause a Denial of Service (DoS) by initiating a Transport Layer Security (TLS) renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught assertion is triggered, terminating the client process and disrupting active network requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is evaluated as an Important severity flaw for Red Hat products because an unauthenticated remote server can terminate a client Node.js process, halting all concurrent tasks and in-flight operations. In typical Red Hat deployments, containerized microservices and administrative consoles rely on undici or runtime fetch APIs to communicate with external web endpoints. Exploitation requires the client application to establish an outbound TLS 1.2 connection to a malicious or compromised endpoint that initiates session renegotiation with a non-matching certificate. Workloads communicating strictly with trusted endpoints or utilizing TLS 1.3 connections are inherently protected, as TLS 1.3 does not permit server-driven renegotiation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87018"
},
{
"category": "external",
"summary": "RHBZ#2553677",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553677"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87018",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87018"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87018",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87018"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm"
}
],
"release_date": "2026-10-15T18:38:25.613000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T13:07:48+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95124"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64",
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate"
},
{
"cve": "CVE-2026-87029",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-10-15T19:23:21.481772+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553726"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A remote malicious or compromised HTTP server can cause a Denial of Service (DoS) by sending a small compressed response that decompresses beyond configured size limits. Because undici fails to catch errors triggered by response handlers during decompression, an unhandled exception is produced that crashes the client application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via unhandled exception in decompress interceptor",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate impact because successful exploitation requires an application to connect to an untrusted or compromised HTTP server and utilize a specific client interceptor configuration. A denial of service condition only occurs when the decompression interceptor is composed with a downstream handler that throws errors upon receiving oversized responses. Standard Red Hat environments that connect exclusively to trusted endpoints or run default HTTP pipelines without this specific combination of interceptors are not susceptible to this failure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87029"
},
{
"category": "external",
"summary": "RHBZ#2553726",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553726"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87029",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87029"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87029",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87029"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6"
}
],
"release_date": "2026-10-15T18:48:36.902000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T13:07:48+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95124"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64",
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor"
},
{
"cve": "CVE-2026-109383",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-15T18:45:43.553803+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security (TLS) verification functions during internal configuration copying, causing the client to silently ignore application-specific checks such as certificate or public-key pinning.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Certificate validation bypass via dropped TLS options in Agent",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having an Important severity for Red Hat products because an attacker positioned on the network could bypass custom cryptographic protections, allowing the interception or tampering of sensitive traffic. Standard system trust stores and default certificate chain validations are not compromised by this flaw, which reduces exposure for environments relying solely on standard public key infrastructure. The elevated risk is restricted to services and applications that configure specialized certificate validation handlers, such as explicit certificate or public key pinning, when establishing outbound connections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109383"
},
{
"category": "external",
"summary": "RHBZ#2553678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109383"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109383",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109383"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/commit/f75eac00ac17",
"url": "https://github.com/nodejs/undici/commit/f75eac00ac17"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx"
}
],
"release_date": "2026-10-15T18:34:01.468000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T13:07:48+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95124"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64",
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent"
},
{
"cve": "CVE-2026-109829",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"discovery_date": "2026-10-15T18:45:59.990034+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553679"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. When an application configures redirect handling alongside a shared cache, responses received after cross-origin redirects are incorrectly stored under the initial request URL. A remote attacker who controls a redirect destination can exploit this vulnerability to poison the shared cache, serving malicious content to subsequent users requesting trusted URLs. Additionally, this behavior can result in information disclosure if private or user-specific responses are cached and delivered to unauthorized callers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because successful exploitation enables remote attackers to achieve shared cache poisoning and unauthorized cross-user data exposure across network boundaries without requiring elevated privileges. Within Red Hat environments shipping Node.js runtimes and associated container services, undici is utilized as an HTTP client backend. However, exploitation requires a specific application architecture where an originless dispatcher chains redirect processing ahead of a shared cache store, rather than the default standalone client configurations. Deployments that do not implement shared caching across multi-origin redirect flows or that isolate cache storage per origin remain unaffected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109829"
},
{
"category": "external",
"summary": "RHBZ#2553679",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553679"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109829"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109829",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109829"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/commit/26c2bfb3def0",
"url": "https://github.com/nodejs/undici/commit/26c2bfb3def0"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26"
}
],
"release_date": "2026-10-15T18:28:04.954000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T13:07:48+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95124"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64",
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching"
},
{
"cve": "CVE-2026-109841",
"cwe": {
"id": "CWE-354",
"name": "Improper Validation of Integrity Check Value"
},
"discovery_date": "2026-10-15T18:42:19.338403+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553669"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. The HTTP client improperly handles case sensitivity when verifying Subresource Integrity (SRI) algorithm tokens. When an application specifies an uppercase or mixed-case algorithm name, undici treats the token as unrecognized and skips verification instead of enforcing it. A remote attacker who controls the HTTP response body can exploit this flaw to deliver modified content without triggering an integrity error, bypassing intended security protections.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In Red Hat environments, this vulnerability is rated as Moderate impact because successful exploitation requires an adversary capable of tampering with network responses alongside the uncommon prerequisite that an application explicitly configured non-lowercase hashing algorithms for Subresource Integrity checks. Standard deployments typically employ lowercase digest names, which properly enforce validation and prevent bypass. Furthermore, the issue is constrained to compromising response integrity when client workloads rely on undici\u0027s fetch implementation under these specific naming conditions, without directly leading to system compromise or arbitrary code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109841"
},
{
"category": "external",
"summary": "RHBZ#2553669",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553669"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109841",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109841"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109841",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109841"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/commit/4f7ef6806e53",
"url": "https://github.com/nodejs/undici/commit/4f7ef6806e53"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472"
}
],
"release_date": "2026-10-15T18:22:06.283000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T13:07:48+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95124"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64",
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens"
},
{
"cve": "CVE-2026-109869",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-10-15T18:31:39.700754+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553656"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. When an application sends a request to a malicious remote server, the server can return a response with excessive content encodings and immediately close the connection. Because the underlying response stream is left unhandled, this abrupt closure triggers an unhandled error that causes the application process to crash. Consequently, an attacker operating a remote server can cause a Denial of Service (DoS), terminating the application even if standard error handling is implemented.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because an unauthenticated remote server can trigger an unhandled runtime error that abruptly terminates the parent Node.js process, bypassing application-level catch blocks. In Red Hat products and containerized workloads running affected Node.js runtimes, the flaw impacts services executing outbound HTTP calls to untrusted or external third-party endpoints. Conversely, deployments where applications only interact with verified internal endpoints or do not fetch content from untrusted remote hosts are not exposed to this denial-of-service condition.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109869"
},
{
"category": "external",
"summary": "RHBZ#2553656",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553656"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109869"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109869",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109869"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/commit/b5084c7dc239",
"url": "https://github.com/nodejs/undici/commit/b5084c7dc239"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"
}
],
"release_date": "2026-10-15T18:08:31.243000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T13:07:48+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95124"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64",
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings"
},
{
"cve": "CVE-2026-109924",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-15T18:34:33.100871+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553663"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A malicious server can trigger a Denial of Service (DoS) by exhausting application memory. When an application connects to an untrusted Server-Sent Events (SSE) feed, the EventSource parser does not properly limit retained internal state when processing fragmented lines or repeated message fields. This allows an attacker to send crafted or compressed responses that consume excessive memory and terminate the application process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via memory exhaustion in EventSource client",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate rather than Important because exploitation requires a Node.js client application to actively connect to an untrusted or compromised Server-Sent Events endpoint. In standard Red Hat product deployments, applications typically consume trusted, internal network services rather than arbitrary external feeds. Additionally, the impact is strictly confined to process termination from resource exhaustion, with no compromise to data confidentiality or system integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109924"
},
{
"category": "external",
"summary": "RHBZ#2553663",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553663"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109924",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109924"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109924",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109924"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/commit/789ef26461c",
"url": "https://github.com/nodejs/undici/commit/789ef26461c"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685"
}
],
"release_date": "2026-10-15T18:16:48.452000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T13:07:48+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95124"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64",
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: undici: Denial of Service via memory exhaustion in EventSource client"
},
{
"cve": "CVE-2026-109932",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-15T19:02:19.103535+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553687"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A malicious or compromised WebSocket server can trigger a Denial of Service (DoS) by repeatedly sending small PING messages while refusing to read the client\u0027s automated replies. Because the client ignores flow-control signals when writing responses to the network socket, unread messages accumulate indefinitely in memory. This unchecked memory consumption can exhaust available system memory and cause the application process to terminate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity because exploitation requires an affected client application to initiate an outbound WebSocket connection to a malicious or compromised remote endpoint, rather than being exposed on inbound service ports. In typical Red Hat environments, Node.js workloads communicate with trusted internal services, limiting the likelihood of interacting with hostile endpoints. Additionally, the blast radius is confined to process crashes resulting from memory exhaustion, with no compromise of data confidentiality or integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109932"
},
{
"category": "external",
"summary": "RHBZ#2553687",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553687"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109932",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109932"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109932",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109932"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6"
}
],
"release_date": "2026-10-15T18:44:22.571000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T13:07:48+00:00",
"details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95124"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64",
"Red Hat Trusted Artifact Signer 1.5:registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.