Vulnerability-Lookup

RHSA-2026:9872

Vulnerability from csaf_redhat - Published: 2026-04-22 21:03 - Updated: 2026-04-23 06:09

Summary

Red Hat Security Advisory: DevWorkspace Operator 0.40.1 release.

Severity

Important

Notes

Topic: DevWorkspace Operator 0.40.1 has been released.

Details: The DevWorkspace Operator extends OpenShift to provide DevWorkspace support.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-25679

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1286 - Improper Validation of Syntactic Correctness of Input

Vendor Fix To start using the DevWorkspace Operator, install the DevWorkspace Operator from OpenShift OperatorHub on OpenShift Container Platform 4.16 or higher. https://access.redhat.com/errata/RHSA-2026:9872

Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

CVE-2026-27137

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-295 - Improper Certificate Validation

CVE-2026-33186

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Workaround To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

References

URL

Category

	https://access.redhat.com/errata/RHSA-2026:9872	self
	https://access.redhat.com/security/cve/CVE-2026-25679	external
	https://access.redhat.com/security/cve/CVE-2026-27137	external
	https://access.redhat.com/security/cve/CVE-2026-33186	external
	https://access.redhat.com/security/updates/classi…	external
	https://redhat.atlassian.net/browse/CRW-10592	external
	https://security.access.redhat.com/data/csaf/v2/a…	self
	https://access.redhat.com/security/cve/CVE-2026-25679	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2445356	external
	https://www.cve.org/CVERecord?id=CVE-2026-25679	external
	https://nvd.nist.gov/vuln/detail/CVE-2026-25679	external
	https://go.dev/cl/752180	external
	https://go.dev/issue/77578	external
	https://groups.google.com/g/golang-announce/c/Edh…	external
	https://pkg.go.dev/vuln/GO-2026-4601	external
	https://access.redhat.com/security/cve/CVE-2026-27137	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2445345	external
	https://www.cve.org/CVERecord?id=CVE-2026-27137	external
	https://nvd.nist.gov/vuln/detail/CVE-2026-27137	external
	https://go.dev/cl/752182	external
	https://go.dev/issue/77952	external
	https://pkg.go.dev/vuln/GO-2026-4599	external
	https://access.redhat.com/security/cve/CVE-2026-33186	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2449833	external
	https://www.cve.org/CVERecord?id=CVE-2026-33186	external
	https://nvd.nist.gov/vuln/detail/CVE-2026-33186	external
	https://github.com/grpc/grpc-go/security/advisori…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "DevWorkspace Operator 0.40.1 has been released.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The DevWorkspace Operator extends OpenShift to provide DevWorkspace support.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:9872",
        "url": "https://access.redhat.com/errata/RHSA-2026:9872"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
        "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27137",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27137"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33186"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/CRW-10592",
        "url": "https://redhat.atlassian.net/browse/CRW-10592"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9872.json"
      }
    ],
    "title": "Red Hat Security Advisory: DevWorkspace Operator 0.40.1 release.",
    "tracking": {
      "current_release_date": "2026-04-23T06:09:32+00:00",
      "generator": {
        "date": "2026-04-23T06:09:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.5"
        }
      },
      "id": "RHSA-2026:9872",
      "initial_release_date": "2026-04-22T21:03:38+00:00",
      "revision_history": [
        {
          "date": "2026-04-22T21:03:38+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-22T21:03:45+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-23T06:09:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "DevWorkspace Operator 0.4",
                "product": {
                  "name": "DevWorkspace Operator 0.4",
                  "product_id": "DevWorkspace Operator 0.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:devworkspace:0.40::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "DevWorkspace Operator"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
                "product": {
                  "name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
                  "product_id": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-rhel9-operator@sha256%3A9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04?arch=amd64\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776457293"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
                "product": {
                  "name": "registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
                  "product_id": "registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-operator-bundle@sha256%3A991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca?arch=amd64\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776559999"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
                "product": {
                  "name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
                  "product_id": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-project-backup-rhel9@sha256%3A798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6?arch=amd64\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776462971"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
                "product": {
                  "name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
                  "product_id": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-project-clone-rhel9@sha256%3A105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750?arch=amd64\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776457327"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
                "product": {
                  "name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
                  "product_id": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-rhel9-operator@sha256%3A78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca?arch=s390x\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776457293"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
                "product": {
                  "name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
                  "product_id": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-project-backup-rhel9@sha256%3A992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962?arch=s390x\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776462971"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
                "product": {
                  "name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
                  "product_id": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-project-clone-rhel9@sha256%3Ae14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34?arch=s390x\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776457327"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
                "product": {
                  "name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
                  "product_id": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-rhel9-operator@sha256%3A7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8?arch=ppc64le\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776457293"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
                "product": {
                  "name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
                  "product_id": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-project-backup-rhel9@sha256%3A0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b?arch=ppc64le\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776462971"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
                "product": {
                  "name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
                  "product_id": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-project-clone-rhel9@sha256%3A03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d?arch=ppc64le\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776457327"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64",
                "product": {
                  "name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64",
                  "product_id": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-rhel9-operator@sha256%3Aa55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2?arch=arm64\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776457293"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
                "product": {
                  "name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
                  "product_id": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-project-backup-rhel9@sha256%3A9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09?arch=arm64\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776462971"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
                "product": {
                  "name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
                  "product_id": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/devworkspace-project-clone-rhel9@sha256%3A053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596?arch=arm64\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776457327"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64 as a component of DevWorkspace Operator 0.4",
          "product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64"
        },
        "product_reference": "registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
        "relates_to_product_reference": "DevWorkspace Operator 0.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le as a component of DevWorkspace Operator 0.4",
          "product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le"
        },
        "product_reference": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
        "relates_to_product_reference": "DevWorkspace Operator 0.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64 as a component of DevWorkspace Operator 0.4",
          "product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64"
        },
        "product_reference": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
        "relates_to_product_reference": "DevWorkspace Operator 0.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x as a component of DevWorkspace Operator 0.4",
          "product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x"
        },
        "product_reference": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
        "relates_to_product_reference": "DevWorkspace Operator 0.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64 as a component of DevWorkspace Operator 0.4",
          "product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64"
        },
        "product_reference": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
        "relates_to_product_reference": "DevWorkspace Operator 0.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le as a component of DevWorkspace Operator 0.4",
          "product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le"
        },
        "product_reference": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
        "relates_to_product_reference": "DevWorkspace Operator 0.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64 as a component of DevWorkspace Operator 0.4",
          "product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64"
        },
        "product_reference": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
        "relates_to_product_reference": "DevWorkspace Operator 0.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64 as a component of DevWorkspace Operator 0.4",
          "product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64"
        },
        "product_reference": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
        "relates_to_product_reference": "DevWorkspace Operator 0.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x as a component of DevWorkspace Operator 0.4",
          "product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x"
        },
        "product_reference": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
        "relates_to_product_reference": "DevWorkspace Operator 0.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le as a component of DevWorkspace Operator 0.4",
          "product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le"
        },
        "product_reference": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
        "relates_to_product_reference": "DevWorkspace Operator 0.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x as a component of DevWorkspace Operator 0.4",
          "product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x"
        },
        "product_reference": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
        "relates_to_product_reference": "DevWorkspace Operator 0.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64 as a component of DevWorkspace Operator 0.4",
          "product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64"
        },
        "product_reference": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
        "relates_to_product_reference": "DevWorkspace Operator 0.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64 as a component of DevWorkspace Operator 0.4",
          "product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
        },
        "product_reference": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64",
        "relates_to_product_reference": "DevWorkspace Operator 0.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-25679",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-03-06T22:02:11.567841+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445356"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
        ],
        "known_not_affected": [
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445356",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/752180",
          "url": "https://go.dev/cl/752180"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77578",
          "url": "https://go.dev/issue/77578"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4601",
          "url": "https://pkg.go.dev/vuln/GO-2026-4601"
        }
      ],
      "release_date": "2026-03-06T21:28:14.211000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-22T21:03:38+00:00",
          "details": "To start using the DevWorkspace Operator, install the DevWorkspace Operator from OpenShift OperatorHub on OpenShift Container Platform 4.16 or higher.",
          "product_ids": [
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:9872"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "cve": "CVE-2026-27137",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-03-06T22:01:38.859733+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445345"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
        ],
        "known_not_affected": [
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27137"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445345",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/752182",
          "url": "https://go.dev/cl/752182"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77952",
          "url": "https://go.dev/issue/77952"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4599",
          "url": "https://pkg.go.dev/vuln/GO-2026-4599"
        }
      ],
      "release_date": "2026-03-06T21:28:13.748000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-22T21:03:38+00:00",
          "details": "To start using the DevWorkspace Operator, install the DevWorkspace Operator from OpenShift OperatorHub on OpenShift Container Platform 4.16 or higher.",
          "product_ids": [
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:9872"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
    },
    {
      "cve": "CVE-2026-33186",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-03-20T23:02:27.802640+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449833"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
        ],
        "known_not_affected": [
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
          "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449833",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
        }
      ],
      "release_date": "2026-03-20T22:23:32.147000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-22T21:03:38+00:00",
          "details": "To start using the DevWorkspace Operator, install the DevWorkspace Operator from OpenShift OperatorHub on OpenShift Container Platform 4.16 or higher.",
          "product_ids": [
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:9872"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
          "product_ids": [
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
            "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
    }
  ]
}

CVE-2026-33186 (GCVE-0-2026-33186)

Vulnerability from cvelistv5 – Published: 2026-03-20 22:23 – Updated: 2026-03-24 18:09

Title

gRPC-Go has an authorization bypass via missing leading slash in :path

Summary

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

Severity ?

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_M

References

URL

Tags

https://github.com/grpc/grpc-go/security/advisori…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	grpc	grpc-go	Affected: < 1.79.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33186",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-24T18:08:38.989284Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-24T18:09:13.422Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grpc-go",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.79.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-20T22:23:32.147Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
        }
      ],
      "source": {
        "advisory": "GHSA-p77j-4mvh-x3m3",
        "discovery": "UNKNOWN"
      },
      "title": "gRPC-Go has an authorization bypass via missing leading slash in :path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33186",
    "datePublished": "2026-03-20T22:23:32.147Z",
    "dateReserved": "2026-03-17T22:16:36.720Z",
    "dateUpdated": "2026-03-24T18:09:13.422Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27137 (GCVE-0-2026-27137)

Vulnerability from cvelistv5 – Published: 2026-03-06 21:28 – Updated: 2026-03-10 13:32

Title

Incorrect enforcement of email constraints in crypto/x509

Summary

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-295 - Improper Certificate Validation

Assigner

References

URL

Tags

	https://go.dev/cl/752182
	https://go.dev/issue/77952
	https://groups.google.com/g/golang-announce/c/Edh…
	https://pkg.go.dev/vuln/GO-2026-4599

Impacted products

	Vendor	Product	Version
	Go standard library	crypto/x509	Affected: 1.26.0-0 , < 1.26.1 (semver)

Credits

Jakub Ciolek

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-27137",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-10T13:32:09.097820Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-10T13:32:53.202Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/x509",
          "product": "crypto/x509",
          "programRoutines": [
            {
              "name": "newEmailConstraints"
            },
            {
              "name": "emailConstraints.query"
            },
            {
              "name": "checkConstraints"
            },
            {
              "name": "checkChainConstraints"
            },
            {
              "name": "parseMailboxes"
            },
            {
              "name": "Certificate.Verify"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.26.1",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jakub Ciolek"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-08T05:56:20.771Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/752182"
        },
        {
          "url": "https://go.dev/issue/77952"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4599"
        }
      ],
      "title": "Incorrect enforcement of email constraints in crypto/x509"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-27137",
    "datePublished": "2026-03-06T21:28:13.748Z",
    "dateReserved": "2026-02-17T19:57:28.434Z",
    "dateUpdated": "2026-03-10T13:32:53.202Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-25679 (GCVE-0-2026-25679)

Vulnerability from cvelistv5 – Published: 2026-03-06 21:28 – Updated: 2026-03-10 13:37

Title

Incorrect parsing of IPv6 host literals in net/url

Summary

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-1286 - Improper Validation of Syntactic Correctness of Input

Assigner

References

URL

Tags

	https://go.dev/cl/752180
	https://go.dev/issue/77578
	https://groups.google.com/g/golang-announce/c/Edh…
	https://pkg.go.dev/vuln/GO-2026-4601

Impacted products

	Vendor	Product	Version
	Go standard library	net/url	Affected: 0 , < 1.25.8 (semver) Affected: 1.26.0-0 , < 1.26.1 (semver)

Credits

Masaki Hara (https://github.com/qnighy) of Wantedly

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-25679",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-10T13:36:26.554241Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-10T13:37:02.459Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/url",
          "product": "net/url",
          "programRoutines": [
            {
              "name": "parseHost"
            },
            {
              "name": "JoinPath"
            },
            {
              "name": "Parse"
            },
            {
              "name": "ParseRequestURI"
            },
            {
              "name": "URL.Parse"
            },
            {
              "name": "URL.UnmarshalBinary"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.1",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Masaki Hara (https://github.com/qnighy) of Wantedly"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "url.Parse insufficiently validated the host/authority component and accepted some invalid URLs."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-06T21:28:14.211Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/752180"
        },
        {
          "url": "https://go.dev/issue/77578"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4601"
        }
      ],
      "title": "Incorrect parsing of IPv6 host literals in net/url"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-25679",
    "datePublished": "2026-03-06T21:28:14.211Z",
    "dateReserved": "2026-02-05T01:33:41.943Z",
    "dateUpdated": "2026-03-10T13:37:02.459Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2026:9872

CVE-2026-33186 (GCVE-0-2026-33186)

CVE-2026-27137 (GCVE-0-2026-27137)

CVE-2026-25679 (GCVE-0-2026-25679)

Tags

Sightings

Nomenclature